SOC Analyst interview question

What indicators suggest lateral movement, and how would you hunt for it?

What interviewers are really testing

• Knowledge of common techniques (SMB, RDP, WMI, PsExec)
• Log sources mapped to techniques
• Cross-host correlation thinking

A strong answer framework

1. Admin-protocol traffic between workstations (SMB/RDP/WMI)
2. New service installs, scheduled tasks, remote thread creation
3. One account logging into many hosts in a short window
4. Pass-the-hash signs: NTLM without Kerberos, odd 4624 logon types
5. Hunt: correlate target process creation with source auth events

Follow-ups you should be ready for

• Which Event IDs matter most?
• How do you separate admin tools from attacker tools?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?