Lateral movement into payments tier

An external adversary established a foothold on wks-2231 and pivoted into the payments service tier within one second — machine-speed lateral movement across a segment boundary.

1. Detected12:57:31Pathfinder

   Pathfinder correlated a foothold on wks-2231 with an SMB session to svc-payments 0.8s later.

2. Enriched12:57:39Pathfinder

   Attack chain mapped: initial access → discovery → lateral movement. Confidence 0.91.

3. Contained12:57:46Warden

   Warden quarantined wks-2231 and revoked the pivoted session token.