Lateral movement is the set of techniques attackers use after an initial break-in to move from one compromised system to others inside the same network.
How lateral movement works
The first infected machine is rarely the real target. Attackers explore the network, collect credentials and hop towards valuable systems: domain controllers, file servers, backups, databases. MITRE ATT&CK lists this as a separate tactic (TA0008). Common methods include:
- remote administration tools built into the system – RDP, SSH, PsExec, WMI, WinRM;
- reusing stolen passwords, hashes and Kerberos tickets (pass-the-hash, pass-the-ticket);
- exploiting unpatched internal services;
- abusing management platforms such as software deployment or remote monitoring tools.
Tools like Mimikatz extract credentials from memory, and BloodHound maps paths to domain admin rights in Active Directory.
Why lateral movement matters for security
Lateral movement is what turns a single infected laptop into a company-wide ransomware incident or a long espionage campaign by an APT group. Because it uses legitimate admin tools and valid accounts (“living off the land”), it can blend into normal traffic. Detection time matters: the faster defenders spot the attacker, the fewer systems are affected.
How to defend
- Segment networks and restrict admin protocols to dedicated management hosts (Zero Trust).
- Use unique local admin passwords, tiered admin accounts and phishing-resistant MFA.
- Collect and correlate authentication logs; alert on unusual RDP, SMB and remote execution activity (EDR, SIEM).
- Keep backups isolated so that attackers cannot reach them from the production network.
