Lateral Movement Detection: Defender & CrowdStrike Docs

Lateral movement detection is a core capability in both Microsoft Defender for Endpoint and CrowdStrike Falcon, and both vendors publish extensive documentation on how their products identify and alert on it. This article directly answers what those documents cover, how the two platforms differ in their approach, and what you should look for when evaluating them.

What Microsoft Defender Documents About Lateral Movement

Microsoft’s Defender for Endpoint documentation describes lateral movement detection as part of its broader threat detection and response capabilities. The key documents include:

• Advanced hunting schema – This is the primary reference for finding lateral movement events. It lists tables like IdentityLogonEvents, DeviceLogonEvents, and DeviceNetworkEvents that contain the raw data needed to trace an attacker’s path from one machine to another.
• Alert descriptions – Each alert type, including those for lateral movement (e.g., “Remote code execution attempt” or “Pass-the-hash”), has a dedicated page explaining what it detects, the MITRE ATT&CK technique it maps to, and recommended investigation steps.
• Hunting queries – Microsoft provides sample KQL (Kusto Query Language) queries that specifically look for patterns like multiple remote logons from a single source or unusual use of administrative shares.

The documentation emphasizes that lateral movement is often detected through a combination of logon events, process creation on remote machines, and network connections to internal IPs. It also highlights the importance of using the “Alert timeline” and “Device timeline” to correlate these events.

What CrowdStrike Documents About Lateral Movement

CrowdStrike Falcon’s documentation, available in its Falcon User Guide and on the CrowdStrike Falcon Sandbox (now Falcon Intelligence), takes a similar but distinct approach. Key resources include:

• Event search schema – CrowdStrike’s event search allows you to query events like UserAccountLogon, NetworkConnectionIP, and ProcessRollup2. Their documentation explains how to use these events to build a “lateral movement” timeline.
• Detection details – Each detection includes a “Lateral Movement” indicator if the Falcon sensor observed behavior consistent with moving across the network, such as remote service creation or scheduled task creation on another host.
• Falcon OverWatch – CrowdStrike documents how its managed hunting team uses the same telemetry to proactively identify lateral movement, and provides case studies and hunting guides.

Unlike Microsoft, CrowdStrike places more emphasis on the “IOA” (Indicator of Attack) approach, which focuses on behavior rather than just signatures. Their documentation explains that lateral movement is often detected through sequences of events that, individually, may look benign.

How Detection Works: Logon Events and Remote Execution

Both platforms rely heavily on telemetry from endpoints. The core detection mechanisms are:

• Logon event analysis – Tracking successful and failed logons, especially those using remote protocols like RDP, SMB, or WinRM. An attacker often uses stolen credentials to log onto multiple machines.
• Remote process creation – Detecting when a process is started on a remote machine via tools like PsExec, WMI, or scheduled tasks. This is a common lateral movement technique.
• Network connection correlation – Flagging connections to internal IPs on administrative ports (445, 3389, 5985) that are unusual for the user or device.
• Credential access – Identifying tools that dump credentials (e.g., Mimikatz) which are often used to obtain the hashes needed for lateral movement.

Both vendors map these behaviors to the MITRE ATT&CK framework, specifically the “Lateral Movement” tactic (TA0008). This makes it easier for analysts to understand the context of an alert.

Key Differences in Documentation and Approach

While both document the same underlying techniques, there are notable differences:

• Data access – Microsoft provides a powerful, queryable data schema (Advanced Hunting) that is available to all customers. CrowdStrike’s event search is also queryable, but some advanced data may require higher-tier subscriptions.
• Alert correlation – Microsoft groups related alerts into “incidents” automatically, which helps see the full attack chain. CrowdStrike uses “detection stories” that link related detections.
• Focus on IOA vs. IOC – CrowdStrike’s documentation emphasizes behavioral indicators (IOA) over static indicators of compromise (IOC). Microsoft also uses behavioral detection but its documentation often includes more guidance on hunting with IOCs like file hashes.
• Integration with other tools – Microsoft’s docs frequently reference integration with Microsoft Sentinel and other Azure services. CrowdStrike’s docs focus on its own console and APIs.

For a security team, the choice often comes down to which ecosystem you’re already invested in. Both provide the necessary data to detect lateral movement if configured correctly.

Common Problems and How to Avoid Them

Even with good documentation, teams make mistakes. The most common issues include:

• Not enabling the right sensors – Both platforms require full endpoint coverage. If some devices are not onboarded, lateral movement can go undetected.
• Ignoring false positives – Legitimate administrative activity can trigger lateral movement alerts. Tuning rules and creating exceptions for known admin tools is essential.
• Only looking at alerts, not hunting – Waiting for alerts to fire is reactive. Both vendors provide hunting queries, but many teams don’t use them proactively.
• Misunderstanding the data schema – The documentation is dense. Take time to learn the specific tables and event types, or you’ll miss important evidence.

A practical tip: start with the vendor’s “advanced hunting” or “event search” tutorials, then build your own queries for your environment.

How to Choose Between Defender and CrowdStrike

There is no one-size-fits-all answer. Consider these factors:

• Existing Microsoft stack – If you’re already using Microsoft 365, Azure AD, and Sentinel, Defender for Endpoint integrates seamlessly and may be more cost-effective.
• Managed detection and response (MDR) – CrowdStrike’s Falcon OverWatch is a well-documented MDR service that can augment your team. Microsoft also offers a similar service, but it’s less prominent in their docs.
• User interface and workflow – Some analysts prefer CrowdStrike’s clean console, while others find Microsoft’s incident view more comprehensive. Try both if possible.
• Budget – Pricing varies widely based on features and user count. Both have transparent pricing pages, but actual costs depend on your needs.

Remember that the documentation is not the product. The real test is how well the tool works in your network.

Frequently Asked Questions

Does Defender for Endpoint detect pass-the-hash attacks?

Yes. Microsoft Defender for Endpoint detects pass-the-hash through behavioral analysis of logon events and process access. The documentation includes specific alert names like “Pass-the-Hash” and provides hunting queries to find related activity.

Can CrowdStrike Falcon detect lateral movement without an internet connection?

Yes, the Falcon sensor works on-premises and can detect lateral movement locally. However, to receive real-time threat intelligence and cloud-based detection updates, the sensor needs periodic connectivity to the CrowdStrike cloud.

Which vendor has better out-of-the-box lateral movement detection?

Both are strong, but they differ in approach. Microsoft’s integration with the broader Microsoft 365 ecosystem can give more context (e.g., user risk), while CrowdStrike’s IOA engine is known for catching novel behavior. The best choice depends on your environment.

Do I need to be a security expert to use these documents?

No, but a basic understanding of networking and Windows authentication helps. Both vendors provide beginner guides and step-by-step tutorials. Start with the “advanced hunting” or “event search” basics.

Are there any free resources to learn lateral movement detection?

Both Microsoft and CrowdStrike offer free webinars, blog posts, and some documentation without a paid subscription. Microsoft’s Learn platform has free modules on threat hunting. CrowdStrike’s blog also publishes detailed analyses of real attacks.

Limits of the Documentation

No documentation covers every possible scenario. Both vendors update their products and docs frequently, so always refer to the latest online version. Also, documentation cannot replace hands-on experience. Use the vendor’s test environment or a lab to practice querying and responding to alerts.

Finally, remember that lateral movement detection is a team effort. Even the best tool will not help if your analysts don’t know how to use it. Invest time in training and regular tabletop exercises.

Related

• Hide Signal Notification Content? How-To
• Disney Plus Buffering Issues? Fixes That Work
• Visual AI in Test Automation: A How-To