Can antivirus or EDR alone catch lateral movement?

Partly. Endpoint detection and response (EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.) sees what happens on each machine where it runs, such as a remote-administration tool starting or credentials being dumped, and good EDR catches a lot of lateral movement that way. What it misses are the hosts without an agent, such as printers, cameras, appliances and unmanaged servers, agents that attackers have switched off, and movement that uses legitimate tools with valid passwords, which looks normal on each single machine. The network sees the relationship between hosts: a workstation suddenly opening administrative sessions to servers it never used. That is why the two work best together. NetSenX flags lateral movement and scanning on every plan, Free included, and from the Pro plan correlates hosts into one story; it does not see what runs inside a host, which remains the EDR's job.

← All 69 questions on Attack techniques explainedAll topics