SOP-06: Lateral Movement Detection & Response

SOC analyst playbook for detecting and responding to lateral movement — Pass-the-Hash, Pass-the-Ticket, PsExec, WMI, and RDP abuse. KQL for Defender/Sentinel, SPL for Splunk, with full Entra ID and Defender XDR containment, eradication, and escalation steps.