By: Jeet Dutta, Data Science

Welcome to the Unraveling Cyber Defense Model Secrets series, where we shine a light on how our Data Science team is keeping up with the latest detections.

One of the most dangerous phases of an attack is lateral movement, where intruders pivot across a network to access sensitive data and high-value systems, making it hard to detect. Identifying this behavior quickly can mean the difference between a contained incident and a full-scale breach.

By leveraging machine learning and advanced log analysis, security teams can uncover the subtle signs of lateral movement — even when attackers try to blend in with normal user activity.

In this blog, we break down how machine learning models, fueled by logon behavior analysis, detect lateral movement. We’ll also share real-world examples from customer vulnerability scans and show how Adlumin’s platform helps stop attackers fast.

Stopping Attackers in Their Tracks with Machine Learning

Once an attacker gains initial access to a network, they often move laterally to gain deeper access, usually in search of sensitive data and other high-value assets. This type of movement can likely be characterized by tracking a user’s logon behavior over distinct periods of time, specifically through the logon events recorded in the Windows security logs (successful logon, event id 4624).

These logs contain information about the type of logon that occurred, along with the time, source computer, and destination computer, which can be used to build directed graphs representing a user’s logon behavior over the course of a day. These graphs can be quantified, and using machine learning, statistically anomalous logon behavior can be detected.

Logon behavior gleaned from this data can also be modeled to learn the context of each access, i.e. machine-learned baselines of normal combinations of user, source host, destination machine, logon type, and time-of-day. Thereafter, the ML model can be applied to flag anomalous logons.

The unique ensemble methodology involving multiple ML models sketched above is the basis for Lateral Movement detection on the platform deployed by the team – a capability often tested via penetration tests and vulnerability scans. Every week we catch pen tests or attackers doing lateral movement.

From the Adlumin perspective, the most important goal is to detect indicators of scans as well as real attacks.

Recent highlights include the following examples of Data Science models alerting us to the suspicious behavior that scans trigger.

• The example below is for a customer that ran a scheduled monthly vulnerability scan. Our Machine Learning model ensemble for Lateral Movement detection flagged the following logon sequence of machine access:

A privileged user from the “compromised” host machine accessed other machines on the network.

• The second example of Lateral Movement alert showcased below; the source device successfully logged on to another machine hosting admin shared drives:

Adlumin’s UEBA (User and Entity Behavior Analytics) models within the Lateral Movement detection ensemble learn “normal” behavior via mathematical representation of access patterns involving users and hosts on the network. Normal behavior baselines are then used to evaluate incoming access events, and any mismatches against the baseline are raised as alerts.

The examples above emphasize the effectiveness of in-house ML detection capability and the UEBA approach: the logon sequences in both incidents are brief and appear ordinary, but machine-learned baselines can tell they are anomalous in the network’s context.

Staying Ahead of Lateral Movement

Detecting lateral movement isn’t just about catching intrusions — it’s about stopping attackers before they reach critical assets. By combining machine learning with detailed logon behavior analysis, Adlumin’s Data Science models provide an essential line of defense, uncovering anomalies that would otherwise blend in as normal activity.

As threat tactics evolve, so must our approach to detection. With proactive monitoring and continuous improvement, we’re committed to helping customers stay one step ahead of cybercriminals — building not only stronger defenses but also lasting confidence in the security of their environments.