SECURITY-OPERATIONS-SOC5 MIN READ
Decide: Admin or Lateral Movement
Choose a response to ambiguous remote admin activity that may indicate lateral movement.
The decisive issue is not whether the tool is allowed. It is whether the account, source, timing, and target pattern match legitimate administration.
Read the full lesson
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in