How Huntress Addresses Lateral Movement

Huntress describes a layered EDR approach to detect lateral movement by focusing on four action pillars (initial execution, transport, remote authentication, remote execution), prioritizing telemetry around remote authentication and execution (source IP/port/hostname, logon type/id). The write-up details detection examples and real-world observations—including MMC/DCOM abuse to execute PowerShell, credential dumping via mmc.exe/rundll32, and activity consistent with ransomware preparation (deleting shadow copies, staging sensitive files)—and explains how this telemetry increases detection fidelity and SOC response.