# Can you detect lateral movement in encrypted traffic?

Largely, yes: who connects to whom, on which port, when and how much data moves are all visible without decryption. What stays hidden is the content of the session, such as the commands sent over an encrypted remote session.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/can-you-detect-lateral-movement-in-encrypted-traffic

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Which MITRE ATT&CK techniques can network detection see?](https://netsenx.com/en/faq/which-mitre-att-ck-techniques-can-network-detection-see)
- [What is C2 beaconing?](https://netsenx.com/en/faq/what-is-c2-beaconing)
- [What is data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-data-exfiltration)
- [What does living off the land mean?](https://netsenx.com/en/faq/what-is-living-off-the-land)
- [Can a rogue device plugged into our network be detected?](https://netsenx.com/en/faq/can-a-rogue-device-on-our-network-be-detected)