Product Overview · E-ITDR

Lateral Movement Detection
and Response

Starting from a compromised endpoint, E-ITDR correlates accounts, authentication, process and network activity to detect suspicious lateral movement, trace the hosts and critical assets involved, and support authorized response with results you can check.

Request a demo Supported environments

Why ITDR

After an endpoint falls, the movement usually looks legitimate

Once inside, attackers mostly work with real accounts and built-in system tools. Detection centred on files and processes sees legitimate tools and legitimate credentials; the anomaly only shows at the identity layer.

Credentials are taken

The system credential store and process memory are accessed abnormally, or the directory service receives a replication request that should never come from this host. Once a credential is in the attacker's hands, everything that follows is technically authorised.

Identity signals: credential access · abnormal replication

The authentication chain does not add up

The same credential appears on several hosts within a short window, tickets are requested in unusual ways and live for unusual lengths, and the path does not match how that account normally authenticates. Each single event holds up; the sequence does not.

Identity signals: cross-host reuse · ticket anomaly · path deviation

Movement heads inward

Cross-host execution started through remote services moves step by step from an office workstation toward critical servers, using the remote management features the operating system ships with. The processes and commands are themselves on the allow list.

Identity signals: remote execution · change in target asset tier

Lateral movement leaves less time to respond

CrowdStrike’s 2026 Global Threat Report puts the average eCrime breakout time in its 2025 observations at 29 minutes, from initial access to lateral movement onto another system. Correlating credentials, authentication and cross-host activity helps focus investigation and response.

CrowdStrike · 2026 Global Threat Report · Observations from 2025

Read the report findings

82%

Of CrowdStrike's 2025 detections, 82% involved no malware.

CrowdStrike, 2026 Global Threat Report

A vendor detection sample, not all attacks worldwide

22%

Of the breaches reviewed in the Verizon 2025 DBIR, 22% used compromised credentials as the initial access vector.

Verizon 2025 DBIR credential research

The sample of breaches reviewed, not a live rate

292 days

In IBM's 2024 report, breaches involving stolen or compromised credentials took 292 days on average to identify and contain.

IBM, Cost of a Data Breach Report 2024, p6

Time to identify and contain, not time to discover alone

The three figures point to attack method, credential entry and investigation difficulty. They come from different organizations and different years, and cannot be added together. E-ITDR covers the endpoint side of this picture: where a credential was used, whether that use was abnormal, and which internal assets the activity reached.

Architecture

Collect at the endpoint, investigate on the platform, close the loop inside the enterprise

E-ITDR consists of agents on supported endpoints and an on-premise management platform. Data, rules, alerts, investigation and response all stay inside the enterprise.

Endpoint agent

Collects host, identity, process, network, file and service data on supported Windows and Linux hosts, and produces security events and collector health in a single format. If the network is interrupted it caches locally and resends after recovery.

Runs with least privilege

On-premise management platform

Handles agent registration and authorization, event ingestion and search, rule and version management, alerting and investigation, response orchestration and operation audit. It runs inside the enterprise and does not depend on external cloud components.

Data stays inside the enterprise

Relationship with existing tools

Agents run independently of an existing EDR without interfering with it, and existing products do not need to be removed. Events and alerts can be sent to an existing SIEM or SOC in a standard format.

Complements EDR, does not replace it

Agents on the endpoint collect evidence and report it; the platform handles detection, correlation and response orchestration; authorized actions are sent back to the endpoint, and the result returns along the same channel for review. The platform does not sit inline with the host's business traffic.

Supported endpoints

Windows / Linux

E-ITDR platform

On-premise

Detect Investigate Respond Audit

Authorized response

Receipt and trail

Events and telemetry

Authorized commands

Execution receipts and audit

Endpoint collection

Detection

Correlation

Authorized response

Review and audit

Structural diagram, not a product screenshot. The actual deployment shape, component count and collection scope depend on the integration plan and the product version.

Capabilities

Five capabilities, following one investigation end to end

From noticing something abnormal, through reconstructing the path, assessing impact, acting and recording the result. Each one can be read on its own.

Identity Threat & Lateral Movement Detection

Find the abnormal activity behind a legitimate identity.

Rules, protocol features and threat intelligence help detect credential abuse, lateral movement, WebShell and suspicious C2 connections, with evidence for review.

View capability

Attack Investigation & Correlation

Turn scattered events into one readable path.

Authentication, processes and connections organised by time and object relationships, reconstructing the cross-host path with gaps marked.

View capability

File Activity & Exfiltration Investigation

From “we were breached” to “what may have been involved”.

Recorded file activity and network-layer transfer statistics, placed on the same timeline as the identity and process evidence.

View capability

Response & Audit

Act under authorization, and check every result.

Issue, receive, execute and review each carry a visible state; high-risk actions are governed by approval and review.

View capability

Asset Identity & Telemetry Management

Give the evidence somewhere stable to land.

Agent identity decoupled from network attributes, attribute changes kept as snapshots, and collection gaps visible as first-class data.

View capability

Environments & Boundaries

Confirm the environment first, then decide where to start

Deployment conditions and capability boundaries are described together. Selection needs a clear scope of applicability, not conclusions without preconditions.

Item	Detail
Deployment	Endpoint agents plus an on-premise management platform. Data, rules, alerts, investigation and response all remain inside the enterprise.
Protected assets and licensing	Office endpoints and servers are licensed separately by quantity. Windows and Linux are supported operating systems; AD is one of the services running on a server.
Endpoint systems	Windows Server 2016 / 2019 / 2022 and Windows 10 / 11; mainstream Linux distributions including Ubuntu, Debian and CentOS / RHEL.
Runtime	The agent runs with least privilege, independently of an existing EDR and without interfering with it. Existing products do not need to be removed.
Channel and credentials	TLS and key-token authentication between agent and platform, with key rotation. The platform verifies agent identity from the authentication context.
Outbound integration	Security events and alerts can be sent to an existing SIEM or SOC in a standard format.
To confirm	OS versions, runtime permissions, audit policy, collection configuration, and the runtime impact on production hosts.

Current capability boundaries

Protocol analysis differs by platform

Linux supports protocol characteristic analysis; Windows primarily uses authentication, process and network events. Coverage depends on the OS, collection configuration and version.

Detection method

Driven by rules, protocol characteristics and threat intelligence, so a judgement can be explained and traced. It does not include a large language model inference engine.

Scope

Focused on identity behaviour at the endpoint. Cloud identity directories such as Entra ID and Okta are not covered; the product complements an existing IAM.

Platform range

Windows and Linux today. Domestic Linux distributions need separate adaptation for kernel, package manager, log paths and service manager, and server testing does not substitute for desktop testing.

Performance data

The design uses on-demand collection, safe degradation and execution constraints. There is no published measured performance data; we recommend confirming it in a pilot environment.

Relationship with EDR

Adds the identity dimension alongside an existing EDR. It is not a replacement for EDR, and does not claim to cover its broad-spectrum detection.

Validate with an agreed scenario

Integration proceeds as “confirm the environment and scenario → validate on a small deployment → expand on the results”, completing one full detection-to-response pass on a limited set of endpoints and critical servers first.

Reproduce the scenario

Detect and correlate

Investigate the path

Act under authorization

Re-test

We recommend agreeing the test scenario, start and end times, evidence standard and runtime conditions before a pilot. Useful observations include coverage of lateral movement behaviour, time to first detection, completeness of path reconstruction, how well the evidence explains itself, time from detection to response, deployment effort, and the sense of false positives. No effectiveness figures are reported before testing is complete.

Resources

Go further

Product material, the adjacent scenario, and how the other product divides the work.

E-ITDR product introduction

Product material

An introduction to lateral movement detection, path investigation and response. Available on request until a public version is released.

Request it

Credential abuse and lateral movement defence

Related scenario

Once an endpoint is compromised, how movement toward critical servers is detected and handled.

View scenario

Web ITDR

Expert Consultation

Assess lateral movement visibility with one internal scenario

Tell us which credential abuse or lateral movement risk concerns you, along with your current endpoints and security products, and we will follow up with a matching demonstration and integration advice:

Environment and scenario check

OS versions, permissions and collection conditions

Scenario-based demonstration

Detection through response, on the risk you care about

Pilot advice

Scope, observations and acceptance criteria

Scan with Feishu to consult

Consultation +86 10 8071 6066

Business email services@wuthreat.com

Product Overview · E-ITDR

Lateral Movement Detectionand Response

Why ITDR

After an endpoint falls, the movement usually looks legitimate

Lateral movement leaves less time to respond

Architecture

Collect at the endpoint, investigate on the platform, close the loop inside the enterprise

Capabilities

Five capabilities, following one investigation end to end

Identity Threat & Lateral Movement Detection

Attack Investigation & Correlation

File Activity & Exfiltration Investigation

Response & Audit

Asset Identity & Telemetry Management

Environments & Boundaries

Confirm the environment first, then decide where to start

Current capability boundaries

Validate with an agreed scenario

Resources

Go further

E-ITDR product introduction

Credential abuse and lateral movement defence

Web ITDR

Expert Consultation

Assess lateral movement visibility with one internal scenario

Environment and scenario check

Scenario-based demonstration

Pilot advice

Lateral Movement Detection
and Response