A researcher trained neural networks to detect lateral movement cyberattacks using only synthetic data from simulated corporate networks, then validated the approach against 1.65 billion real authentication logs from Los Alamos National Laboratory. The synthetic-trained models ranked suspicious login windows effectively, identifying real attacks in the top results with far fewer false alarms than traditional threshold methods.
A blog post explores a Linux PAM (Pluggable Authentication Modules) security feature that can enable lateral movement during red team engagements. The author explains how PAM centralizes authentication across Linux systems and focuses on the account stage, highlighting the pam_access module as relevant to the vulnerability.