{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/lateral-movement","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/lateral-movement/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/lateral-movement/"},"term":{"en":"Lateral movement","da":"Lateral bevægelse"},"aka":{"en":[],"da":["lateral movement"]},"domain":["security"],"cluster":"fundamentals","layer":"network","status":"current","summary":{"en":"What an attacker does after getting a first foothold - spreading from machine to machine inside the network.","da":"Det, en angriber gør efter at have fået fodfæste - at sprede sig fra maskine til maskine inde i netværket."},"body":{"formal":{"en":"The stage of an attack in which an intruder who controls one system uses stolen logins and trust between systems to reach others, working toward the most valuable data or accounts.","da":"Den fase af et angreb, hvor en ubuden gæst, der har kontrol over ét system, bruger stjålne logins og tillid mellem systemer til at nå andre og arbejde sig frem mod de mest værdifulde data eller konti."},"plain":{"en":"A burglar who gets in through the garage and then walks freely through every unlocked door in the house.","da":"En indbrudstyv, der kommer ind gennem garagen og derefter går frit gennem alle ulåste døre i huset."},"inPractice":{"en":"After infecting a receptionist's PC at a Danish regional hospital, an attacker finds an administrator's saved login on it and uses it to reach first the file server and then the systems holding patient data.","da":"Efter at have inficeret en receptionists pc på et regionshospital finder en angriber et gemt administratorlogin på den og bruger det til at nå først filserveren og derefter de systemer, der rummer patientdata."},"whyItMatters":{"en":"A single weak machine becomes a disaster only if the attacker can move on from it, so limiting that spread keeps small breaches small.","da":"En enkelt svag maskine bliver kun en katastrofe, hvis angriberen kan komme videre derfra - at begrænse spredningen holder små brud små."}},"deepDive":{"en":"In MITRE ATT&CK, Lateral Movement is tactic TA0008 and sits after Initial Access, Privilege Escalation, Credential Access (TA0006) and Discovery (TA0007) in the typical intrusion flow, although real intrusions loop through these repeatedly rather than following them in order. Its technique families include Remote Services (T1021, covering RDP, SMB, WinRM, SSH), Use Alternate Authentication Material (T1550) and Lateral Tool Transfer (T1570). The defining property for defenders is that lateral movement mostly reuses legitimate protocols and valid credentials, so each individual hop resembles normal administration and cannot be caught by malware signatures alone.\n\nIn Windows and Active Directory environments the enabling factor is credential material cached on hosts. Because protocols such as NTLM and Kerberos let a client prove identity with a hash or a ticket rather than a re-typed password, credentials harvested from one compromised host can be reused against others - the pattern defenders summarise as pass-the-hash and pass-the-ticket. Attackers also map the directory (the approach popularised by BloodHound) to find the shortest chain of group memberships and sessions leading to highly privileged accounts. The 2017 NotPetya event illustrated the risk: after entering via a trojanised update of the Ukrainian accounting package M.E.Doc, automated credential reuse combined with the EternalBlue SMB flaw let it propagate across global corporate networks within hours, causing losses later estimated in the billions of dollars.\n\nDefensive controls work by breaking credential reuse and reducing reachability. Unique per-host local administrator passwords (Windows LAPS) prevent one recovered secret from opening every machine; a tiered administration model keeps domain-admin credentials off ordinary workstations; Credential Guard and the Protected Users group limit what can be extracted from memory. Host firewalls that block workstation-to-workstation SMB, RDP and WinRM remove paths clients rarely need, and network segmentation with Zero Trust access (NIST SP 800-207) shrinks the set of systems any one foothold can reach. Just-in-time and just-enough administration shorten the window in which powerful credentials exist at all.\n\nDetection leans on authentication and telemetry rather than file scanning: Windows logon events (notably 4624 network logons, 4648 explicit-credential use and 4769 Kerberos service tickets) correlated in a SIEM reveal a single account touching many hosts in a short time, unusual source-destination pairs, or administrative tooling appearing where it does not belong. This distinguishes lateral movement from privilege escalation, which raises rights on one host, and from the initial access that first gets an attacker inside; lateral movement is specifically the horizontal spread between systems of comparable trust.","da":"I MITRE ATT&CK er lateral bevægelse taktikken TA0008 og placeres efter Initial Access, rettighedseskalering, Credential Access (TA0006) og Discovery (TA0007) i det typiske angrebsforløb, selv om virkelige angreb løber gennem faserne gentagne gange snarere end i fast rækkefølge. Teknikfamilierne omfatter Remote Services (T1021 - RDP, SMB, WinRM, SSH), Use Alternate Authentication Material (T1550) og Lateral Tool Transfer (T1570). Det afgørende for forsvarere er, at lateral bevægelse for det meste genbruger legitime protokoller og gyldige loginoplysninger, så hvert enkelt spring ligner almindelig administration og ikke kan fanges af malware-signaturer alene.\n\nI Windows- og Active Directory-miljøer er den muliggørende faktor loginmateriale, der ligger cachet på maskinerne. Fordi protokoller som NTLM og Kerberos lader en klient bevise sin identitet med en hash eller en billet frem for en genindtastet adgangskode, kan oplysninger hentet fra én kompromitteret maskine genbruges mod andre - det mønster, forsvarere kalder pass-the-hash og pass-the-ticket. Angribere kortlægger desuden kataloget (den tilgang, BloodHound gjorde udbredt) for at finde den korteste kæde af gruppemedlemskaber og sessioner frem til stærkt privilegerede konti. NotPetya-hændelsen i 2017 viste risikoen: efter at være kommet ind via en trojaniseret opdatering af det ukrainske regnskabsprogram M.E.Doc lod automatisk genbrug af loginoplysninger kombineret med SMB-fejlen EternalBlue den sprede sig på tværs af globale virksomhedsnetværk i løbet af timer og forårsagede tab, der senere blev anslået til milliarder af dollars.\n\nDefensive kontroller virker ved at bryde genbrug af loginoplysninger og mindske, hvad et fodfæste kan nå. Unikke lokale administratoradgangskoder pr. maskine (Windows LAPS) forhindrer, at én fundet hemmelighed åbner alle maskiner; en lagdelt administrationsmodel holder domæneadministrator-oplysninger væk fra almindelige arbejdsstationer; Credential Guard og gruppen Protected Users begrænser, hvad der kan trækkes ud af hukommelsen. Host-firewalls, der blokerer SMB, RDP og WinRM mellem arbejdsstationer, fjerner veje, klienter sjældent har brug for, og netværkssegmentering med Zero Trust-adgang (NIST SP 800-207) indsnævrer mængden af systemer, ét fodfæste kan nå. Just-in-time- og just-enough-administration forkorter det tidsrum, hvor stærke loginoplysninger overhovedet findes.\n\nDetektion bygger på autentificerings- og telemetridata frem for filscanning: Windows-logonhændelser (især 4624 netværkslogon, 4648 brug af eksplicitte loginoplysninger og 4769 Kerberos-servicebilletter) korreleret i et SIEM afslører én konto, der rører mange maskiner på kort tid, usædvanlige kilde-mål-par eller administrationsværktøjer, der dukker op, hvor de ikke hører hjemme. Det adskiller lateral bevægelse fra rettighedseskalering, som hæver rettigheder på én maskine, og fra det initiale fodfæste, der først bringer angriberen ind; lateral bevægelse er netop den vandrette spredning mellem systemer med sammenlignelig tillid."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/credential","confidence":"high","strength":"normal"},{"type":"exploits","to":"security/vulnerability","why":{"en":"It abuses too-broad access and the trust systems give each other inside the network.","da":"Den udnytter for bred adgang og den tillid, systemer giver hinanden inde i netværket."},"confidence":"medium","strength":"primary"},{"type":"causes","to":"security/data-breach","why":{"en":"Moving further inside is how an attacker reaches the data worth stealing.","da":"Det er ved at bevæge sig længere ind, at angriberen når de data, der er værd at stjæle."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"security/mitre-attack","why":{"en":"Lateral movement is one of the named tactics in the ATT&CK catalogue.","da":"Lateral bevægelse er en af de navngivne taktikker i ATT&CK-kataloget."},"confidence":"medium","strength":"normal"}],"depth":2,"sources":[{"title":"MITRE ATT&CK - Lateral Movement (TA0008)","url":"https://attack.mitre.org/tactics/TA0008/","tier":"reference","publisher":"MITRE"},{"title":"NIST SP 800-207 - Zero Trust Architecture","tier":"standard","publisher":"NIST"}],"draft":true}