A SOC team wants to detect lateral movement performed using legitimate administrative tools rather than...

The correct answer isauthentication and remote execution logs. Lateral movement using legitimate tools relies heavily oncredential use and remote management protocols, not malware execution.

Attackers commonly use:

RDP

SMB administrative shares

WinRM

WMI

SSH

These techniques generateauthentication events, remote logons, and service execution logsrather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.

Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.

Authentication telemetry enables hunters to detect anomalies such as:

Logons between non-associated systems

Sudden administrative access

Credential reuse across hosts

Abnormal session timing and frequency

This data is foundational forcredential-based attack detection, which remains one of the most common breach paths today. It also aligns withMITRE ATT&CK Lateral Movement and Credential Access tactics.

Thus, optionCis the correct answer.