Lateral movement
noun · MITRE ATT&CK TA0008
The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.
The first machine an attacker compromises is rarely the one they want. Lateral movement is everything they do to get from that foothold to valuable targets: file servers, domain controllers, cloud admin accounts. It usually relies on legitimate tools and stolen credentials rather than malware, which is what makes it hard to spot.
Common techniques include Remote Desktop, PowerShell remoting, SMB with administrative shares, remote services and pass-the-hash or pass-the-ticket attacks with stolen credential material.
Example
An attacker phishes a help desk employee, dumps cached credentials from their laptop, and finds a server administrator's password hash. They use it to connect to a file server over SMB, and from there reach a domain controller.
Why it matters for a SOC analyst
Catching lateral movement early can turn a breach into a contained incident. Watch for accounts logging on to many machines in a short time, administrative tools used from unusual sources, and workstations connecting to each other directly. On Windows, logon events such as 4624 with logon type 3 (network) or 10 (remote interactive) are a good starting point.
Related terms
- Pass-the-hash
Authenticating as a user with their stolen password hash instead of the password itself, abusing how NTLM works to move between Windows systems.
- Privilege escalation
Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.
- MITRE ATT&CK
A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.