This is where lateral movement detection becomes critical. After initial access, attackers rarely move directly to their final objective. They explore the environment, identify valuable systems, reuse credentials, test access paths, move from workstation to server, and establish communication channels that blend into normal traffic. Much of this activity can happen after the firewall has already done its job according to policy: it allowed legitimate-looking traffic from a trusted internal source.
Network traffic remains one of the most reliable sources of post-compromise evidence. Endpoints can be tampered with, logs can rotate, credentials can look legitimate, and administrative tools can be abused for malicious purposes. The network still records communication between systems. It shows which host connected to which destination, which ports were used, when the activity happened, how often it repeated, and how much data moved.
For SOC teams and security architects, this changes the detection model. The question is no longer limited to whether the perimeter stopped the attack. The more important question is whether the organization can detect the attacker after access has already been gained.
Table of Contents
The perimeter myth — why assume breach is the starting point
The perimeter remains important, but it no longer represents the full security boundary of the organization. Modern environments include remote users, cloud workloads, SaaS applications, VPNs, third-party access, hybrid infrastructure, unmanaged assets and internal systems that communicate across multiple network zones. Attackers can arrive through phishing, stolen credentials, exposed services, compromised suppliers, vulnerable applications or abused remote access paths.
Once initial access is established, the firewall has limited visibility into what happens inside the environment. Traditional perimeter controls are strongest at inspecting north-south traffic: communication entering or leaving the organization. Lateral movement often happens as east-west traffic between internal systems, where perimeter devices may not observe the connection at all.
This creates a dangerous visibility gap. A compromised workstation may connect to file shares, domain controllers, application servers, databases, backup systems or administrator workstations without triggering a perimeter alert. A legitimate remote desktop session between two internal hosts may be allowed by policy. SMB traffic may look normal because the protocol is common. PowerShell remoting, WMI, PsExec-style execution and administrative ports may be part of routine IT operations.
Assume breach is therefore a practical operating model, not a pessimistic slogan. It recognizes that prevention can fail, credentials can be stolen, and trusted systems can become attacker infrastructure. Under this model, security teams need the ability to observe what happens after the first foothold: internal reconnaissance, credential-based movement, command-and-control traffic, privilege expansion and data staging.
The network becomes the evidence layer that connects these events.
Why attackers go quiet after initial access
After gaining access, skilled attackers often reduce their noise. They avoid obvious malware execution, use legitimate tools, move through valid accounts and prefer protocols that already exist in the environment. This strategy is commonly described as living off the land: abusing trusted binaries, administrative utilities and built-in operating system capabilities to perform malicious actions while blending into normal operations.
The advantage for the attacker is clear. Security tools are more likely to allow activity that resembles approved administration. A remote login with valid credentials may look less suspicious than a malware payload. A PowerShell command launched by an administrator account may look like automation. SMB, RDP, WMI, WinRM, SSH and HTTPS are widely used in legitimate environments, so blocking them outright is rarely possible.
Endpoint detection can identify many of these behaviors, especially when telemetry is available and the attacker leaves process, command-line, memory or file-system evidence. But attackers also know how to target endpoint visibility. They may disable sensors, tamper with logs, move through unmanaged systems, use bring-your-own-vulnerable-driver techniques, abuse signed tools, operate from servers with weaker coverage or rely on credentials to make activity appear authorized.
Network behavior is harder to avoid because almost every post-compromise objective requires communication. The attacker has to discover systems, connect to internal services, authenticate to remote hosts, move tools or data, maintain C2, reach staging locations or exfiltrate information. Even when the traffic uses legitimate protocols, the pattern can still stand out from the normal baseline.
A quiet attacker may avoid malware signatures. A quiet attacker still has to move.
The one thing an attacker can’t avoid — the network
Internal network visibility turns post-compromise detection from a tool-specific problem into a communication-pattern problem. Instead of relying only on whether a process looks malicious, analysts can ask whether a system is behaving like itself.
A finance workstation that suddenly connects to multiple servers over SMB after hours is behaving differently from its normal role. A web server that initiates RDP sessions to internal systems may deserve immediate review. A user endpoint that reaches a domain controller, then a file server, then an external VPS provider in a short time window is creating a sequence that can be reconstructed from network metadata.
Flow data is especially useful here because it summarizes communication at scale. NetFlow, IPFIX, sFlow and similar telemetry can show source, destination, ports, protocols, timestamps, duration, bytes, packets and direction. This is enough to detect many lateral movement patterns, even without packet payload.
East-west traffic — the blind spot of perimeter security
East-west traffic is communication between systems inside the environment. It may occur within the same VLAN, between subnets, across data center segments, between cloud workloads, or through internal routing and firewall layers. In a well-segmented network, east-west traffic should follow expected paths. In a flat or partially segmented network, it can become the attacker’s preferred movement layer.
Perimeter security often misses this activity because the traffic never crosses the internet edge. A firewall may block malicious inbound traffic and still provide little insight into workstation-to-server movement, server-to-server pivots or internal scans. Even when internal firewalls exist, logs may be difficult to correlate with endpoint, identity and application context.
Flow-based east-west monitoring helps identify:
- new host-to-host conversations;
- unusual access to administrative ports;
- one-to-many internal scanning patterns;
- communication across segments that should remain isolated;
- unexpected traffic from user networks to server networks;
- servers initiating connections to workstations;
- internal systems contacting rare external destinations after lateral movement;
- changes in traffic volume, frequency or direction.
The value comes from comparison. A single RDP connection may be normal for an administrator workstation and suspicious for a finance laptop. SMB traffic may be expected between file servers and clients but unusual between two unrelated workstations. East-west detection becomes stronger when the network baseline includes asset roles, zones, normal communication paths and historical behavior.
Why endpoint-only detection isn’t enough
EDR is one of the most important security controls in modern environments. It provides process visibility, behavioral detection, response capabilities and host-level evidence that network telemetry cannot replace. The issue is not whether endpoint detection matters. The issue is whether endpoint-only visibility is sufficient after an attacker has already entered the environment.
In many real environments, endpoint telemetry is incomplete. Some systems are unmanaged. Some servers have limited sensors because of performance or compatibility requirements. Some legacy systems cannot run modern agents. Some cloud workloads are short-lived. Some attacker activity occurs through valid accounts and approved administrative tools. Some network devices, appliances and infrastructure systems do not provide endpoint-style telemetry at all.
Network flow analysis acts as a backstop. It does not need to see the process name to show that a host connected to ten internal servers over SMB in five minutes. It does not need payload to show repeated outbound HTTPS sessions to the same rare destination. It does not need endpoint coverage on every asset to reveal that traffic crossed a prohibited zone boundary.
The strongest detection architecture combines EDR and NDR. Endpoint telemetry explains what happened on the host. Network telemetry shows how systems communicated. Identity logs explain which accounts were used. Firewall and proxy logs provide policy and perimeter context. Together, these sources create a more complete timeline than any single layer can provide alone.
Signatures of lateral movement in network flow data
Lateral movement is rarely a single event. It is usually a sequence of communication patterns that develop after initial access. Flow data helps identify that sequence by showing how the attacker moves from one system to another, which services are used, and how the communication differs from the baseline.
Credential-based movement
Credential-based movement is common because valid credentials reduce friction for the attacker. Techniques such as Pass-the-Hash, Pass-the-Ticket, credential dumping followed by remote login, or abuse of administrator accounts can result in traffic that uses legitimate services. At the network layer, the technique itself may not be directly visible, but the movement pattern often is.
Flow-based indicators include:
| Network pattern | Why it matters |
|---|---|
| New SMB traffic between unrelated hosts | May indicate file access, remote execution preparation or administrative share abuse. |
| RDP from a non-admin workstation to servers | May indicate unauthorized interactive access. |
| WMI or WinRM traffic from an unusual source | May indicate remote command execution using legitimate administrative mechanisms. |
| PsExec-like behavior over SMB and service control paths | May indicate remote execution after credential compromise. |
| One privileged host reaching many systems in a short window | May indicate credential reuse or automated movement. |
| Connections to domain controllers followed by movement to servers | May indicate credential or directory reconnaissance before lateral movement. |
The key is role awareness. Administrative protocols are not malicious by default. They become suspicious when the source, destination, time, frequency or sequence does not fit the normal operating model.
A strong investigation looks for new relationships: host pairs that were not seen before, administrative ports used outside maintenance windows, and internal access that begins shortly after a suspicious external connection or endpoint alert.
Internal reconnaissance and scanning
Attackers need to understand where they are. After compromise, they may enumerate hosts, scan ports, query directory services, identify shares, look for databases, discover backup systems or map network segments. Some of this activity may happen through endpoint commands, but the resulting communication appears on the network.
Flow data can reveal reconnaissance through patterns such as:
- one source contacting many internal destinations;
- many short connections to multiple ports;
- sequential access across IP ranges;
- sudden increase in failed or incomplete sessions;
- first-time communication with sensitive segments;
- DNS or directory-related traffic followed by broader internal access;
- scanning from a host that does not normally perform administrative tasks.
A useful detection method is to track new conversation pairs over time. In a stable environment, most systems communicate with a predictable set of peers. A workstation that normally talks to a domain controller, a proxy and a few application servers should not suddenly attempt connections to dozens of servers, databases or management interfaces.
Internal reconnaissance can be subtle. A slow scan spread over hours may avoid simple threshold-based alerts. Flow analytics can still identify the change if the platform maintains baselines for host behavior, ports and peer relationships.
C2 beaconing
Command-and-control traffic often uses common protocols such as HTTP, HTTPS or DNS because these protocols are allowed in most environments. Tools such as Cobalt Strike allow operators to configure beacon timing, including sleep intervals and jitter, so the traffic does not always appear as perfectly regular check-ins.
At the flow level, C2 beaconing may appear as a pattern of recurring connections from an internal host to the same external destination or domain. The traffic may use low volume, similar byte counts, repeated TLS sessions, periodic DNS requests or consistent intervals with slight variation.
Flow-based indicators include:
| Beaconing indicator | Flow observation |
|---|---|
| Fixed interval | Connections repeat every defined number of minutes. |
| Jittered interval | Connections repeat around an average interval with variation. |
| Low-and-slow activity | Small amounts of data exchanged over a long period. |
| Common protocol abuse | HTTP, HTTPS or DNS used for attacker communication. |
| Rare destination | Host communicates with an external IP or ASN rarely seen in the environment. |
| Multi-host pattern | Several internal systems begin contacting the same destination. |
Beaconing detection should be treated as behavioral analysis rather than simple signature matching. Many legitimate tools also generate periodic traffic, including update services, telemetry agents, cloud applications and monitoring platforms. The difference is usually found in the combination of rarity, timing, host role, destination reputation, relationship to other suspicious activity and persistence over time.
Flow data is well suited to this type of analysis because it can retain communication patterns over long periods. A single outbound connection may be ambiguous. A three-week pattern of periodic connections from the same endpoint to an unusual external destination is stronger evidence.
Mapping to MITRE ATT&CK
Mapping lateral movement and post-compromise activity to MITRE ATT&CK helps structure the investigation and translate technical findings into a common language. Flow data supports ATT&CK mapping at the behavioral level. It shows communication patterns that may be consistent with specific tactics and techniques, especially when combined with endpoint, identity and log evidence.
| ATT&CK tactic | Relevant technique | Flow-based evidence |
|---|---|---|
| TA0007 Discovery | T1018 Remote System Discovery / T1046 Network Service Discovery | One-to-many connections, sequential scanning, access to multiple ports |
| TA0008 Lateral Movement | T1021 Remote Services | New RDP, SSH, SMB or WinRM communication between internal hosts |
| TA0008 Lateral Movement | T1570 Lateral Tool Transfer | File transfers between internal systems over SMB or related services |
| TA0011 Command and Control | T1071 Application Layer Protocol | Recurring HTTP, HTTPS or DNS communication with external infrastructure |
| TA0010 Exfiltration | T1041 Exfiltration Over C2 Channel | Unusual outbound transfers following internal movement |
The wording of the final report should distinguish observation from interpretation. Flow data may show that a host initiated new RDP sessions to multiple servers after communicating with a suspicious external destination. That observation can support a lateral movement hypothesis, especially when correlated with authentication logs or EDR evidence. The strongest reports combine flow evidence with user, process and system-level data to show both the communication path and the mechanism behind it.
From perimeter defense to internal visibility — NDR as the layer after the firewall
Network Detection and Response does not replace firewalls, EDR, SIEM or identity security. Its role is to provide visibility across the communication layer that connects those controls. In a defense-in-depth architecture, NDR becomes the layer that helps detect what happens when prevention has been bypassed or when a trusted internal system becomes part of the attack path.
Perimeter tools answer questions about traffic entering and leaving the environment. EDR answers questions about host-level behavior where sensors are present. SIEM correlates events from many sources. NDR focuses on communication behavior across internal and external paths.
This is especially important for post-compromise detection because attackers rely on movement. They need to connect, authenticate, enumerate, transfer, stage and communicate. These actions create network evidence even when the tools used are legitimate.
A mature internal visibility model should include:
- broad monitoring of east-west traffic;
- baselines for normal host-to-host communication;
- detection of new or rare internal conversations;
- monitoring of administrative protocols;
- C2 and beaconing analytics;
- segmentation validation;
- visibility into cloud and hybrid network paths;
- long-term flow retention for lookback and investigation;
- correlation with endpoint, identity, firewall and proxy data.
The objective is not to generate more alerts. The objective is to give analysts the context needed to distinguish normal operations from post-compromise behavior and to reconstruct the attack path with evidence.
Detecting lateral movement with flow analysis in Sycope
In Sycope, flow analysis can support lateral movement detection by turning network communication into searchable, historical and behavior-oriented evidence. NetFlow, IPFIX, sFlow and related telemetry can be used to monitor east-west traffic, detect unusual host-to-host communication and investigate suspicious sequences after an alert appears.
A practical workflow may look like this:
- Start from an alert, suspicious host, IOC or unusual traffic pattern.
- Review all internal and external conversations for the host in the relevant time window.
- Compare current communication with historical baseline behavior.
- Identify new host pairs, new ports, new destinations and new cross-zone paths.
- Review administrative protocols such as SMB, RDP, SSH, WMI or WinRM.
- Check whether other hosts show similar C2 or beaconing behavior.
- Quantify any outbound transfer that follows internal movement.
- Build a timeline connecting first alert, lateral movement, C2 and possible exfiltration.
The value of this workflow comes from pivoting. A single endpoint alert can lead to a host. The host can lead to all internal systems it contacted. Those systems can lead to additional external destinations or new internal paths. Flow data allows the analyst to expand the investigation without depending only on the first alerting tool.
Sycope can also support baseline-driven detection. In stable environments, many internal conversations are predictable. When a workstation suddenly communicates with servers it has never contacted before, when a server starts initiating outbound connections to rare destinations, or when traffic crosses a segment boundary that should remain restricted, flow analysis can surface the change.
For SOC teams, this helps detect attackers who have already bypassed the firewall. For security architects, it provides evidence about whether segmentation and internal controls are working in practice. For incident responders, it supports reconstruction of the attack timeline from the first suspicious communication to the broader blast radius.
The result is a practical post-compromise visibility layer. Firewalls help control access at the perimeter. EDR helps explain activity on protected endpoints. Flow-based NDR helps show how the attacker moved through the network after the first control was bypassed.
FAQ
How do you detect an attacker who already passed the firewall?
Detection after the firewall requires internal visibility. Security teams should monitor east-west traffic, administrative protocols, new host-to-host conversations, C2 beaconing patterns, unusual outbound destinations and deviations from normal communication baselines.
Firewalls remain important, but they often focus on north-south traffic. Once an attacker operates from a trusted internal host, network flow analysis and NDR help identify suspicious communication inside the environment.
What does lateral movement look like in network traffic?
Lateral movement often appears as new or unusual internal communication. Common signs include SMB, RDP, SSH, WMI or WinRM traffic from unexpected sources, one host connecting to many internal systems, cross-zone communication, connections outside maintenance windows and new host pairs that were not present in the historical baseline.
The most important factor is context. The same protocol may be normal for an administrator workstation and suspicious for a regular user endpoint.
Can NetFlow detect command-and-control or beaconing?
NetFlow can help detect C2 and beaconing by showing recurring communication patterns. It can reveal that a host connects to the same destination at regular intervals, uses common protocols such as HTTP, HTTPS or DNS, exchanges small amounts of data over time, or contacts rare external infrastructure.
NetFlow does not show encrypted payload contents. Its value is in timing, frequency, direction, duration and volume analysis.
EDR vs NDR for lateral movement — do you need both?
Yes, in most mature security programs EDR and NDR should complement each other. EDR provides host-level evidence, such as processes, command lines, file activity and malware behavior. NDR provides network-level evidence, such as internal communication paths, C2 patterns, east-west traffic and segmentation violations.
Using both gives analysts a stronger timeline. EDR explains what happened on a host, while NDR shows how that host communicated with the rest of the environment.
What is east-west traffic and why is it a blind spot?
East-west traffic is communication between systems inside the environment, such as workstation-to-server, server-to-server or workload-to-workload traffic. It can become a blind spot when security monitoring focuses mainly on the perimeter.
Attackers often rely on east-west traffic after initial access because they need to move from the first compromised host toward more valuable systems. Monitoring this traffic helps detect lateral movement, reconnaissance and internal policy violations.
