Hunting for Lateral Movement using Event Query Language

This report provides a practical detection playbook for lateral movement, demonstrating how to use Elastic’s Event Query Language (EQL) to correlate host and network telemetry across techniques such as SMB-based tool transfer and remote execution, Scheduled Tasks, Remote Registry manipulation, and SharpRDP. It explains key behaviors, event sequences, and correlation points (process, network, registry, file, and module-load events) on both source and target hosts, and includes example EQL hunts and detection logic to reduce false positives and improve triage.