Lateral movement

In MITRE ATT&CK, Lateral Movement is tactic TA0008 and sits after Initial Access, Privilege Escalation, Credential Access (TA0006) and Discovery (TA0007) in the typical intrusion flow, although real intrusions loop through these repeatedly rather than following them in order. Its technique families include Remote Services (T1021, covering RDP, SMB, WinRM, SSH), Use Alternate Authentication Material (T1550) and Lateral Tool Transfer (T1570). The defining property for defenders is that lateral movement mostly reuses legitimate protocols and valid credentials, so each individual hop resembles normal administration and cannot be caught by malware signatures alone.

In Windows and Active Directory environments the enabling factor is credential material cached on hosts. Because protocols such as NTLM and Kerberos let a client prove identity with a hash or a ticket rather than a re-typed password, credentials harvested from one compromised host can be reused against others - the pattern defenders summarise as pass-the-hash and pass-the-ticket. Attackers also map the directory (the approach popularised by BloodHound) to find the shortest chain of group memberships and sessions leading to highly privileged accounts. The 2017 NotPetya event illustrated the risk: after entering via a trojanised update of the Ukrainian accounting package M.E.Doc, automated credential reuse combined with the EternalBlue SMB flaw let it propagate across global corporate networks within hours, causing losses later estimated in the billions of dollars.

Defensive controls work by breaking credential reuse and reducing reachability. Unique per-host local administrator passwords (Windows LAPS) prevent one recovered secret from opening every machine; a tiered administration model keeps domain-admin credentials off ordinary workstations; Credential Guard and the Protected Users group limit what can be extracted from memory. Host firewalls that block workstation-to-workstation SMB, RDP and WinRM remove paths clients rarely need, and network segmentation with Zero Trust access (NIST SP 800-207) shrinks the set of systems any one foothold can reach. Just-in-time and just-enough administration shorten the window in which powerful credentials exist at all.

Detection leans on authentication and telemetry rather than file scanning: Windows logon events (notably 4624 network logons, 4648 explicit-credential use and 4769 Kerberos service tickets) correlated in a SIEM reveal a single account touching many hosts in a short time, unusual source-destination pairs, or administrative tooling appearing where it does not belong. This distinguishes lateral movement from privilege escalation, which raises rights on one host, and from the initial access that first gets an attacker inside; lateral movement is specifically the horizontal spread between systems of comparable trust.