Lateral movement hides inside ordinary internal communications. If defenders do not know what normal east-west traffic looks like, attacker movement can resemble routine service interaction, delaying triage and containment while the compromise expands.
Why missing context makes internal movement look ordinary
Missing context removes the baseline defenders use to separate normal east-west traffic from malicious pivots. In most environments, lateral movement does not start with an obvious exploit signal; it starts with a legitimate protocol, a valid session, or a tool already expected to operate inside the network. Without asset, identity, and communication context, those actions blend into routine service-to-service behaviour.
That is why the same remote access, remote management, admin share, or authentication event can mean very different things depending on where it appears, which account is used, and whether the destination is typical for that source. The gap is not just visibility, it is interpretation.
MITRE ATT&CK Enterprise Matrix helps here because lateral movement is best understood as a sequence of techniques, not a single alert. Mapping observed activity to the attack chain makes it easier to see when ordinary-looking connections are actually part of credential access, privilege escalation, or internal spread.
What defenders lose when east-west traffic has no baseline
Defenders lose the ability to judge what is normal for a specific host, user, workload, or application pair. A connection that would be benign between two approved services may be highly suspicious if it comes from a workstation, a jump host, or an account that never touches that segment. Without context, triage becomes noisy and attackers gain time to expand.
Missing context also hides the difference between a single allowed action and a pattern of movement. Repeated authentication attempts, unusual tool invocation, and access to admin interfaces can look harmless in isolation. With inventory, topology, and identity context, those events become a sequence that points to pivoting rather than routine administration.
Top 10 NHI Issues is useful because visibility gaps, ownership gaps, and excessive permissions all make east-west abuse harder to distinguish from legitimate automation. When teams cannot tell which machine or service should be talking to which system, anomalous movement is much harder to isolate early.
Storm-2949 Azure Breach illustrates the problem in practice, because a single compromise can quickly become a broader tenant intrusion once the attacker can move through trusted internal relationships. The more normal the internal communications look, the easier it is for the attacker to stay below the threshold that triggers immediate containment.
Why context is the difference between detection and delay
Context turns raw telemetry into a judgment about intent. Defenders need to know not only that a connection occurred, but whether the source normally initiates it, whether the destination is sensitive, whether the account has a history of that access path, and whether the timing fits established work patterns. That is what allows a detection rule to distinguish drift, administration, and compromise.
In practice, the most useful context is usually a combination of identity, role, asset criticality, and communication normality. If a help desk workstation suddenly reaches a domain controller, or a service account starts touching systems outside its usual enclave, the event becomes meaningful. If the team lacks that context, the alert may never rise above background noise.
MGM Resorts breach 2023 shows how trusted access paths can be abused once an attacker gains a foothold, and why internal movement is so difficult to spot when the traffic resembles normal administrative use. Salt Typhoon telecom intrusions 2025 further demonstrates that valid credentials and trusted infrastructure can support long-term persistence when defenders do not have enough context to flag the movement as unusual.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0008 — Lateral Movement | Explains internal pivoting as a distinct adversary objective. |
| Recommendation — Map east-west anomalies to lateral movement techniques and investigate adjacent access paths. | ||
| NIST CSF 2.0 | DE.AE-03 — Anomalies are analyzed to determine whether cybersecurity events are occurring | Missing context prevents anomaly analysis on internal traffic. |
| Recommendation — Correlate east-west traffic with asset and identity context before treating it as benign. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing internal activity in context, not only collecting logs. |
| AC-6 — Least Privilege | Excess authority makes internal movement easier to hide and harder to contain. | |
| Recommendation — Review internal access logs for unusual source-destination and account-use patterns. Restrict privileges so unexpected east-west access stands out and has less blast radius. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Internal movement becomes visible only when logs are collected and correlated well. |
| Recommendation — Centralize and analyze logs for abnormal internal access chains and privilege use. | ||
Practitioner Guidance
What to prioritise: Build a baseline for east-west communication by identity, workload, and segment, not just by port or protocol. The highest-value signals are repeated source-destination pairs, unusual admin paths, and accounts that initiate access outside their normal function.
What to verify: Confirm that detections can answer three questions together: who initiated the connection, what that actor normally accesses, and whether the destination is expected for that role. If any one of those is missing, treat the alert as incomplete rather than low severity.
Common mistake: Teams often tune for rare payloads or malware markers but underinvest in internal communication context. That leaves them blind to the much quieter stage where an attacker is simply moving from one trusted system to another.
Practitioner takeaway: Lateral movement is hardest to detect when defenders only see traffic, not relationships; the fastest way to improve detection is to make internal communications legible in terms of normal source, normal destination, and normal authority.
Related resources from NHI Mgmt Group
- Why do hybrid environments make lateral movement harder to detect?
- Why does a fragmented security stack make it harder to detect lateral movement and early intrusion?
- Why do stolen machine keys make lateral movement harder to detect?
- Why does stolen credential access make lateral movement harder to detect in hybrid cloud?