<p>Advanced persistent threats often use stolen or legitimate credentials to move stealthily across networks, making them difficult to detect with traditional security systems. This study introduces a novel framework called dual classifier-based lateral movement detection (DC-LMD-APTs), designed to identify such covert behaviours through a combination of feature engineering and hybrid deep learning. Data from the Sysmon-based LMD-2023 dataset, were enhanced with six statistical descriptors, one entropy feature, and one grass berger entropy-based mutual information (GBE-MI) feature, resulting in 101 features used for model training and validation. Data from the Sysmon-based LMD-2023 dataset, originally containing 95 raw features, were enhanced with six statistical descriptors, one entropy feature, and one GBE-MI feature, resulting in 101 features used for model training and validation. The data is first cleaned and normalized using Pareto-based variable stability normalization (P-VSN) to suppress noise and stabilize variance, followed by GBE-MI weighting to identify the most informative and non-redundant attributes. Unlike previous studies that train deep models directly on raw or unweighted features, the proposed approach employs entropy-guided and information-theoretic feature optimization, enabling the model to focus on highly discriminative attributes that improve generalization and reduce overfitting. Unlike conventional deep-learning models, DC-LMD-APTs applies convolutional neural network (CNN) and long short-term memory (LSTM) architectures to structured Sysmon log data arranged into a correlation matrix, where the PRCNN branch extracts spatial relationships among features and the Bi-LSTM models temporal dependencies of event sequences. This dual-domain learning enables effective detection of multi-stage APT behaviours. In experiments, the framework achieved 98.7% accuracy, 98.75% precision, 98.2% recall, and 97.1% specificity, outperforming CNN, LSTM, and DenseNet baselines. These results were achieved through the integration of P-VSN normalization, entropy-based feature weighting, and spatial–temporal fusion, which collectively enhanced learning stability, interpretability, and robustness. Extensive evaluations, including K-fold cross-validation, ablation studies, and SHAP-based explainability, confirm the reliability and scalability of the proposed model for real-time detection of lateral movements in large networks.</p>