What Is Lateral Movement? Techniques, Detection and Testing

Lateral movement is how an attacker who already controls one system reaches other systems, accounts and cloud resources in the same environment. MITRE ATT&CK tracks it as tactic TA0008, with nine techniques that range from remote services such as RDP, SMB and WinRM to pass-the-hash, pass-the-ticket and stolen cloud tokens. Attackers usually move with valid credentials and built-in admin tools, so the activity looks like routine administration. Defenders stop it by limiting where privileged credentials work, segmenting east-west traffic and watching for unusual logons between hosts.

What Is Lateral Movement in Cybersecurity?

The first machine an attacker compromises is rarely the one they want. A phished laptop, an exposed VPN appliance or a stolen contractor password gets them inside, but the data, the domain controller or the payment system sits somewhere else. Lateral movement is the set of techniques they use to close that distance: exploring the network, collecting credentials and pivoting through hosts and accounts until they reach the objective.

MITRE ATT&CK summarizes the tactic in one line: "The adversary is trying to move through your environment." Its description adds two points that matter for defenders. Adversaries may install their own remote access tools, or they may use legitimate credentials with native network and operating system tools, which ATT&CK notes may be stealthier. Most modern intrusions take the second route.

The word "lateral" describes direction. Security teams often split traffic into north-south (in and out of the network) and east-west (between internal systems). Perimeter controls watch north-south. Lateral movement happens east-west, between workstations, servers, identity systems and cloud tenants that usually trust each other more than they trust the internet. That is why one compromised endpoint can become a full domain compromise if nothing slows the attacker down.

Lateral movement matters for almost every serious attack type. Ransomware operators move laterally to reach backups and as many servers as possible before encrypting. Espionage groups move laterally to reach mailboxes, file shares and engineering systems while staying quiet. Data thieves move laterally to find the databases worth stealing.

Lateral movement vs privilege escalation vs pivoting

These terms overlap in reports, but each describes a different change in the attacker's position:

In a real intrusion these steps repeat in a loop. The attacker discovers what is reachable, steals credentials on the current host, moves to the next host with those credentials and starts again. Each loop can raise privileges, which is why lateral movement and privilege escalation are so often described together. For the vertical side of that loop, see our guide to privilege escalation.

Where Lateral Movement Sits in MITRE ATT&CK (TA0008)

The ATT&CK Enterprise matrix lists 15 tactics in version 20, released October 13, 2026. Lateral Movement (TA0008) sits after Credential Access (TA0006) and Discovery (TA0007) and before Collection (TA0009). That order reflects the usual dependency: attackers need to know what exists and hold credentials that work before they can move, and they move so they can collect or act on something.

For how the whole matrix is organized and how teams use it for detection coverage, see our MITRE ATT&CK framework guide.

In the cyber kill chain, lateral movement falls inside the final stage, actions on objectives.

TA0008 currently contains nine techniques. The table summarizes each in plain terms and where defenders usually find evidence of it.

Each technique has its own ATT&CK page with procedure examples and detection guidance. The ones that recur in the advisories covered later in this guide are Remote Services (T1021) and Use Alternate Authentication Material (T1550), followed by Exploitation of Remote Services (T1210), Lateral Tool Transfer (T1570) and Software Deployment Tools (T1072).

Common Lateral Movement Techniques Explained

The techniques below describe how attackers move, not how to reproduce it. They are the patterns a defender or tester needs to recognize.

Remote services: RDP, SMB admin shares, WinRM and SSH

The simplest lateral movement uses the same remote access protocols administrators use every day. With a valid account, an attacker can open a Remote Desktop session, connect to administrative SMB shares, run remote commands through Windows Remote Management (WinRM) or DCOM, or log in over SSH on Linux and macOS. ATT&CK groups these as sub-techniques of T1021.

Because the protocol and the account are legitimate, a single event proves little. The signal comes from context: a help desk account logging on to a domain controller, a workstation opening RDP sessions to other workstations, or one account authenticating to dozens of servers in a few minutes. Remote execution tools also tend to create services or scheduled tasks on the destination host, which leaves its own trail.

Pass-the-hash and pass-the-ticket

Windows does not always need a cleartext password to authenticate. With NTLM, a stolen password hash can be presented directly; ATT&CK records this as Pass the Hash (T1550.002). With Kerberos, a stolen ticket can be reused without the password; ATT&CK records this as Pass the Ticket (T1550.003).

Both techniques depend on where credentials are left behind. Every time a privileged account logs on interactively to a workstation or server, material that can be reused may remain on that host. One shared local administrator password across hundreds of laptops turns a single stolen hash into access to all of them. Our guide to what pass-the-hash is and how to detect it covers the NTLM mechanics, Windows log evidence and the specific hardening steps in more depth.

Exploiting internal services

Sometimes attackers do not need credentials at all, because an internal service has a known vulnerability that runs their code. WannaCry is the textbook case. In May 2017 it spread across networks through the SMBv1 flaw fixed in Microsoft's MS17-010 update, according to CISA alert TA17-132A. The underlying bug, CVE-2017-0144, sits in CISA's Known Exploited Vulnerabilities catalog. Internal servers that are rarely patched because "they are not internet-facing" are exactly where this technique works.

Admin tools, deployment platforms and living off the land

Attackers prefer tools that are already installed. PowerShell, WMI, built-in network commands and remote management agents let them move without dropping malware that endpoint tools would flag. This approach is called living off the land, and our explainer on living off the land (LOTL) attacks describes the main binaries and why they are hard to block.

Centralized platforms raise the stakes. ATT&CK's Software Deployment Tools technique names SCCM, Microsoft Intune, AWS Systems Manager, Azure Arc and GCP Deployment Manager among the systems that can push code to many machines at once. An attacker who controls one of these consoles does not need to move host by host. They can reach every endpoint the platform manages.

Cloud identity pivoting

Lateral movement no longer stops at the network edge. In hybrid environments, the same identity often works on premises and in the cloud, so a stolen Active Directory credential can become a cloud sign-in. ATT&CK covers this with Remote Services: Cloud Services (T1021.007), which describes logging in to cloud services with accounts that are synchronized with or federated to on-premises identities, and with Direct Cloud VM Connections (T1021.008) for console-based access to virtual machines.

Tokens matter as much as passwords in the cloud. Application access tokens (T1550.001) and web session cookies (T1550.004) let an attacker act as a user without signing in again; ATT&CK notes that session cookies can bypass some multifactor authentication protocols because the session is already authenticated. OAuth applications with broad permissions are another pivot: an attacker who can grant consent to a malicious app, or take over an existing over-privileged one, can keep access even after the original account is reset.

Real Lateral Movement Campaigns From CISA Advisories

Government advisories are the best public record of how lateral movement actually unfolds, because they describe confirmed intrusions step by step.

Volt Typhoon: valid admin credentials and RDP toward OT

CISA advisory AA24-038A, released February 7, 2024 by CISA, NSA, FBI and international partners, describes the PRC state-sponsored group Volt Typhoon pre-positioning inside US critical infrastructure IT networks. The agencies observed the group maintaining access in some environments for at least five years.

The lateral movement pattern was consistent. After initial access through vulnerable network appliances, the actors obtained administrator credentials, then used them to move to the domain controller and other devices over RDP. In one water and wastewater sector compromise, they moved over a nine-month period to a file server, a domain controller, an Oracle Management Server and a VMware vCenter server. The vCenter server sat next to OT assets and held saved remote session profiles for water treatment plants, wells and an electrical substation. The advisory also records the use of PsExec for remote execution and repeated theft of the Active Directory database to keep credentials current.

What made the campaign hard to see was its reliance on valid accounts and native tools. The advisory notes the actors sometimes avoided using compromised credentials outside normal working hours to stay below alert thresholds. Our Volt Typhoon profile covers the group's targets and history beyond lateral movement.

Scattered Spider: from the help desk to SSO, vCenter and cloud

CISA advisory AA23-320A, first published November 16, 2023 and revised July 29, 2025, shows lateral movement that is mostly identity-driven. Scattered Spider actors social-engineered help desks into resetting passwords and transferring MFA, then took over accounts in single sign-on environments and registered their own MFA devices.

Once inside, they searched SharePoint for credential documentation, enumerated Active Directory and looked for VMware vCenter infrastructure and backups. In AWS environments, the advisory describes them using Systems Manager Inventory to find targets for lateral movement, then moving to existing and newly created EC2 instances. Their toolset was largely legitimate remote management software, which the advisory lists in a dedicated table.

CISA's own red team: from phishing to every site

CISA advisory AA23-059A, released February 28, 2023, documents a three-month CISA red team assessment of a large critical infrastructure organization with geographically separated sites. The team moved laterally from a phished workstation to a SharePoint server with Kerberos unconstrained delegation enabled, used that position to compromise the domain controller, and then moved across sites with forged Kerberos tickets and management servers.

Two details stand out. Active Directory showed 52 recently active hosts with unconstrained delegation enabled, and firewall rules allowed SMB traffic to configuration management servers at every site, which gave the team a path across the segmentation. Despite a mature security posture, the organization did not detect the activity. MFA prompts did stop the team from reaching one of the sensitive business systems, which shows where a single control changed the outcome.

Midnight Blizzard: OAuth applications as a cloud pivot

Microsoft's January 25, 2024 analysis of the Midnight Blizzard intrusion shows the cloud version of the same idea. The Russian state-sponsored actor, also tracked as APT29, used a password spray to compromise a legacy, non-production test tenant account that did not have MFA. It then found a legacy test OAuth application with elevated access to Microsoft's corporate environment, created additional malicious OAuth apps and used them to access corporate mailboxes. No workstation-to-server hop was needed; the movement happened entirely between identities and applications.

What the four cases have in common

The pattern is clear: attackers moved with legitimate credentials, tickets or app permissions far more often than with exploits. That also explains why intrusions can stay hidden. Mandiant's M-Trends 2026 report puts the global median dwell time for 2025 investigations at 14 days, up from 11, and at 122 days for cyber espionage and North Korean IT worker incidents.

How to Detect Lateral Movement

Signature-based detection struggles here. CISA's Volt Typhoon advisory notes that conventional indicators of compromise are generally lacking for living-off-the-land activity, and that many organizations lack the baselines needed to tell malicious behavior from legitimate administration. Detection therefore depends on relationships: which accounts log on where, from which hosts, with which protocol, and whether that has happened before.

Telemetry that reveals lateral movement

Microsoft documents the logon types for event 4624, along with event 4648 and event 4769. The RDP and ESENT event IDs come from the detection table in CISA advisory AA24-038A.

Five detections to build first

1. First-seen admin logons. Alert when a privileged account logs on to a host it has never accessed, especially a domain controller, hypervisor management server or backup server.
2. Workstation-to-workstation administration. In most networks, laptops have no reason to open RDP, SMB admin share or WinRM connections to other laptops. Treat that traffic as suspicious until proven otherwise.
3. Authentication fan-out. Flag one account or one source host authenticating to an unusual number of destinations within minutes.
4. Remote service creation. Correlate a network logon with a new service or scheduled task on the same host shortly afterward.
5. Identity changes followed by access. In the cloud, link MFA resets, new OAuth consents or new role assignments to the sign-ins and API calls that follow them.

Each detection needs a baseline. The joint CISA guidance on identifying and mitigating living off the land techniques, published February 7, 2024, recommends centralized logging, behavior analytics and baselines of normal administrative activity for exactly this reason.

How to Prevent Lateral Movement

No single control stops lateral movement. The goal is to make every hop harder, louder and less rewarding, so an attacker who lands on one machine cannot quietly reach everything else.

Segment east-west traffic

Lack of network segmentation appears on the NSA and CISA list of the ten most common misconfigurations, published October 5, 2023 from red team, blue team, hunt and incident response work. Start with the paths attackers use most: block RDP, SMB and WinRM between user workstations, restrict administrative protocols to dedicated management hosts, and put domain controllers, hypervisor management, backup systems and OT gateways in zones that only named administrative systems can reach. The CISA red team case shows why rules need review: a single broad SMB allowance to management servers bridged every site. Zero trust architecture, as described in NIST SP 800-207, extends the same principle by evaluating each access request instead of trusting network location.

Tier administrative access

Microsoft's enterprise access model, which evolved from the older Active Directory tier model, separates a control plane (identity systems such as domain controllers), a management plane and a data and workload plane, and asks organizations to prevent control of higher planes from lower ones. In practice that means separate admin accounts per tier, no domain administrator logons to ordinary workstations or servers, and privileged access workstations for control-plane work. If a Tier 0 credential never touches a user laptop, stealing credentials from that laptop cannot hand over the domain.

Remove shared local administrator passwords with Windows LAPS

Microsoft's Windows LAPS documentation notes that local administrator accounts often share the same password across many devices, which attackers can exploit to move laterally. Windows LAPS rotates each device's local administrator password and stores it in Active Directory or Microsoft Entra ID, and Microsoft lists protection against pass-the-hash and lateral-traversal attacks among its benefits. This is one of the highest-value, lowest-cost fixes in most Windows estates.

Enforce phishing-resistant MFA, and know its limits

MFA on remote access, cloud consoles and privileged actions removes many of the easiest pivots. CISA lists phishing-resistant MFA among the actions to take today in both the Volt Typhoon and Scattered Spider advisories, and MFA prompts stopped CISA's own red team at one sensitive system. MFA does not cover everything, though. Pass-the-hash and pass-the-ticket reuse material from an already authenticated session on internal protocols, and stolen session cookies can bypass some MFA flows. Pair MFA with the credential protections below and with help desk procedures that verify identity before resetting MFA.

Protect credentials where they are stored

Credential Guard isolates secrets on Windows endpoints, and the Protected Users group adds restrictions for high-value accounts. Remove Kerberos unconstrained delegation wherever it is not essential, retire unused service accounts and rotate privileged credentials after any suspected compromise. Each step reduces the credentials an attacker can harvest on the hosts they reach.

Keep EDR coverage and centralized logging complete

Detection only works where telemetry exists. The Volt Typhoon advisory's actions to take today include turning on application, access and security logging and storing it in a central system. M-Trends 2026 adds that attackers increasingly persist on edge appliances that do not support EDR. Inventory which servers, hypervisors and appliances lack endpoint coverage, and close the gaps on the systems attackers most want to reach.

Lock down cloud identity paths

Review OAuth applications and service principals for broad app-only permissions, remove legacy test apps and tenants, and alert on new consents. Microsoft's Midnight Blizzard guidance recommends auditing the privilege level of all identities, users, service principals and applications. Keep cloud administrator roles to a minimum, require phishing-resistant MFA for them, and watch for synchronized on-premises accounts that suddenly appear in cloud management consoles.

Which control breaks which technique

How an Internal Pentest or Red Team Measures Lateral Movement

Configuration reviews tell you what should be blocked. Testing tells you what actually is. Lateral movement is one of the main things an internal penetration test and a red team engagement measure, but the two answer different questions.

An internal penetration test starts from an assumed-breach position, such as a standard domain user on a corporate laptop, and maps as many paths to sensitive systems as the scope and time allow. Our internal penetration testing methodology and checklist explains how those tests are scoped and run, and network penetration testing covers the wider infrastructure view. A red team engagement pursues an agreed objective, such as reaching a payment system, while testing whether the security team detects and responds. A purple team exercise then replays the techniques with defenders watching, to turn misses into working detections.

What a good test measures

• Starting position. Which account, device and network segment the test began from, so results can be compared over time.
• Paths to Tier 0 and crown jewels. Every route found from the starting point to domain admin rights, identity systems, backups, hypervisors or named business systems.
• Hops and credentials per path. How many systems and which credentials each path needed, showing which single fix breaks the most paths.
• ATT&CK technique coverage. Each step mapped to a TA0008 technique ID, so findings line up with detection engineering work.
• Detection outcome per step. For each technique: prevented, logged only, alerted, responded or missed.
• Controls that held. Segmentation rules, MFA prompts or tiering that stopped a path, which is evidence worth keeping too.

The scorecard below is an illustrative example of how results can be reported. It does not describe a real engagement.

Lab-safe ways to check your own exposure

Before commissioning a test, teams can measure part of the picture safely. Graph-based Active Directory analysis tools, such as BloodHound (documented by MITRE as software S0521), show which accounts have admin rights where and how they chain together; run them only with authorization. The open-source Atomic Red Team library maps small tests to ATT&CK techniques, which detection engineers can run in an isolated lab to confirm that alerts fire. Never run technique tests against production systems or systems you do not own without written approval and an agreed window.

When you choose a provider, ask how they report paths and detection outcomes, whether findings are mapped to ATT&CK technique IDs, and whether a retest confirms that fixes actually broke the paths.

Frequently Asked Questions

What is a lateral movement attack?

A lateral movement attack is the stage of an intrusion in which an attacker who already has access to one system uses it to reach other systems, accounts or cloud resources. It usually relies on stolen credentials and legitimate remote access tools rather than new malware, and it continues until the attacker reaches their objective or is stopped.

Is lateral movement the same as privilege escalation?

No. Lateral movement changes which system or account the attacker controls; privilege escalation changes how much permission they hold. They often alternate in a loop, because each new system can expose more powerful credentials.

What are the most common lateral movement techniques?

Remote services such as RDP, SMB admin shares, WinRM and SSH (ATT&CK T1021) and the reuse of stolen authentication material such as password hashes, Kerberos tickets and cloud tokens (T1550) recur throughout the CISA advisories covered in this guide. Exploiting unpatched internal services and abusing software deployment tools are also common.

Can MFA stop lateral movement?

MFA blocks many pivots that rely on a stolen password, especially for remote access and cloud consoles, and it stopped CISA's red team at one sensitive system in advisory AA23-059A. It does not stop reuse of hashes or Kerberos tickets on internal protocols, and stolen session cookies can bypass some MFA flows, so it needs to be combined with credential protection and segmentation.

How do you detect lateral movement?

Collect logon, Kerberos, RDP, service creation, EDR and cloud identity logs centrally, then look for behavior that breaks the baseline: privileged accounts on new hosts, workstation-to-workstation admin traffic, one account authenticating to many hosts, and identity changes followed by new access.

Does zero trust prevent lateral movement?

Zero trust reduces it by evaluating each access request instead of trusting network location, as NIST SP 800-207 describes. It does not remove the need for segmentation, credential hygiene and monitoring, and most organizations implement it gradually, so testing still shows where implicit trust remains.

Next Step: Find Your Lateral Movement Paths Before an Attacker Does

Lateral movement turns one compromised laptop into an organization-wide incident, and the paths that allow it are usually configuration choices that can be fixed once someone maps them. Start with the controls in this guide: LAPS, tiered admin accounts, east-west segmentation and logging on the systems that matter most.

To see which paths exist in your environment today, DeepStrike's penetration testing services include manual infrastructure testing and red team engagements, with reports that give reproduction steps, root causes and remediation guidance. For objective-based testing of detection and response, see red teaming services.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• MITRE ATT&CK: Lateral Movement, Tactic TA0008
• MITRE ATT&CK: Enterprise tactics
• MITRE ATT&CK: Updates (v20, October 13, 2026)
• MITRE ATT&CK: Remote Services, T1021
• MITRE ATT&CK: Remote Services: Cloud Services, T1021.007
• MITRE ATT&CK: Use Alternate Authentication Material, T1550
• MITRE ATT&CK: Pass the Hash, T1550.002
• MITRE ATT&CK: Pass the Ticket, T1550.003
• MITRE ATT&CK: Exploitation of Remote Services, T1210
• MITRE ATT&CK: Lateral Tool Transfer, T1570
• MITRE ATT&CK: Software Deployment Tools, T1072
• MITRE ATT&CK: BloodHound, Software S0521
• CISA AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (February 7, 2024)
• CISA AA23-320A: Scattered Spider (November 16, 2023; revised July 29, 2025)
• CISA AA23-059A: CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks (February 28, 2023)
• CISA AA23-278A: NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations (October 5, 2023)
• CISA and partners: Identifying and Mitigating Living Off the Land Techniques (February 7, 2024)
• CISA TA17-132A: Indicators Associated With WannaCry Ransomware
• NVD: CVE-2017-0144
• Microsoft Threat Intelligence: Midnight Blizzard, guidance for responders on nation-state attack (January 25, 2024)
• Google Cloud: M-Trends 2026
• Microsoft Learn: Windows LAPS overview
• Microsoft Learn: Enterprise access model
• Microsoft Learn: Credential Guard
• Microsoft Learn: Protected Users security group
• Microsoft Learn: Event 4624, an account was successfully logged on
• Microsoft Learn: Event 4648, a logon was attempted using explicit credentials
• Microsoft Learn: Event 4769, a Kerberos service ticket was requested
• NIST SP 800-207: Zero Trust Architecture