Catching Lateral Movement Before It Reaches the Crown Jewels
Attackers almost never land directly on the crown jewels. They gain a foothold on one machine — an ordinary, unimportant user workstation — and from there they crawl sideways, machine to machine, until they reach the file server or the DC. Classic antivirus and EDR look at a single host; they miss exactly what happens between hosts. NDR looks at the traffic itself.
Why east-west is the blind spot
A typical attack is a chain: initial access (phishing, stolen credential) → lateral movement (east-west, machine to machine) → impact (ransomware encryption, data theft). A security tool that looks at one machine sees a process running and a port listening — but it doesn't see that this machine is suddenly speaking SMB to ten other machines it never spoke to before. That's the signature of lateral movement, and it's visible only when you look at the internal network as a system.
How we catch lateral movement
Doogree historizes the internal peer connections of every machine — the IP, the port, and the process that initiated the connection. For each connection we classify the port to an ATT&CK technique: SMB → T1021.002, RDP → T1021.001, WinRM → T1021.006, SSH → T1021.004, VNC → T1021.005. After the learning window, a first-ever internal peer on an admin/remote-control port is a lateral-movement candidate — and it surfaces as a behavioral DNA anomaly, tagged with the precise technique.
Logon identity as DNA (servers)
The flip side of the same coin is who logs in, and from where. The server agent reports the human accounts and the successful logins from auth.log — the account, the source IP address, and whether it's a root/admin login. The cloud builds a baseline of the known accounts and the known logon sources. A new account, or an admin/root login from an IP that's never been seen, is a critical anomaly — an account-takeover candidate — mapped to T1078 (Valid Accounts) and T1098.
It all folds into one attack story
These two capabilities don't live alone. They fold into the SIEM correlation engine as stages in the kill chain: the lateral movement is the lateral stage, and the logon-identity anomaly is the access stage. Instead of two isolated alerts, you get one incident that tells a story: someone logged in from a foreign source, then crawled sideways over WinRM — with automatic severity escalation.