Mitigating lateral movements
We can use Microsoft Defender for Identity, which includes a mechanism to detect lateral movements, and a powerful alternate method to remediate lateral movements is by configuring Fusion in Microsoft Sentinel, a correlation engine to detect multistage attacks automatically.
Fusion is a powerful engine integrated with Microsoft Sentinel that identifies combinations of anomalous behaviors and malicious activities observed at different kill chain stages.
Microsoft Sentinel can generate incidents with multiple alerts or activities, and Fusion will correlate all signals from various products and detect advanced attacks. Fusion detections will be shown as Fusion incidents on the Microsoft Sentinel Incidents page. Fusion incidents are stored in the SecurityIncident table in Logs.
How can we enable Fusion? It is enabled as an analytics rule and can help us cover a variety of scenarios, such as the following:
- Compute resource abuse
- Credential...
