Lateral Movement: Techniques, Detection and Testing

Lateral movement is how an attacker who has compromised one machine spreads to others on the same network, using stolen credentials and the remote-management features administrators already rely on, until they reach what they came for: a domain controller, a file server, the backups. MITRE ATT&CK tracks it as tactic TA0008, with nine techniques and 14 sub-techniques in ATT&CK v20.1 (checked in November 2026). It is the stage that turns one phished laptop into a company-wide incident, and the hardest to see, because done well it looks like an administrator doing their job.

Below: the techniques, the event IDs that catch them, the controls that stop them, and how an internal network penetration test measures how far it gets, at a fixed price from $6,000.

What is lateral movement in cyber security?

Lateral movement is the post-compromise phase in which an attacker moves from the first host they control to other hosts, accounts and services. It is a loop: land on a host, harvest its credentials, use them to reach the next host, and repeat until one opens the systems that matter. It is horizontal, where privilege escalation is vertical, and real intrusions alternate: escalate on one host to dump credentials, then move sideways.

CrowdStrike’s 2026 Global Threat Report puts eCrime “breakout time”, from initial compromise to the first move to another system, at 29 minutes on average and 27 seconds at the fastest. CISA’s advisory on the Akira ransomware group (revised November 13, 2025) describes the same playbook: RDP, SSH, remote-access tools and Impacket, with data stolen in some incidents just over two hours after initial access. How ransomware attacks work places this stage in the kill chain.

How a lateral movement attack unfolds

Every hop needs three things, and each is a place to break the chain.

1. A target. Which hosts exist, who is logged on where, and which accounts administer which machines. Any domain user can read most of Active Directory, which is why BloodHound can map the paths from one account to Domain Admin in minutes.
2. Something to authenticate with. A password in a script or share, a service account password recovered by Kerberoasting, an SSH private key left on a jump host, a hash or Kerberos ticket pulled from memory (the job Mimikatz is known for), or an NTLM challenge-response captured by name poisoning with a tool like Responder, then cracked offline or relayed to another host.
3. A remote-execution channel. SMB and the administrative shares, WMI, WinRM, RDP or SSH: the protocols IT uses every day. Testers drive them with toolkits such as Impacket, NetExec and Evil-WinRM. Attackers often run the same hops from inside a C2 implant such as Cobalt Strike Beacon, which has remote-execution commands built in.

On internal tests the most common accelerant is one credential that works in too many places: a shared local administrator password, or a privileged account that leaves its credentials on ordinary desktops.

Lateral movement techniques

The nine ATT&CK techniques, and what each one tells you when a tester succeeds with it:

Technique (ATT&CK ID)	In plain terms	What success reveals
Remote Services (T1021)	Valid credentials over RDP, SMB admin shares, DCOM, SSH, VNC, WinRM or cloud access paths	Remote rights granted too widely; management protocols open between peers
Use Alternate Authentication Material (T1550)	A hash, Kerberos ticket, token or session cookie used in place of a password	Reusable credentials cached on hosts; NTLM still accepted
Exploitation of Remote Services (T1210)	An unpatched internal service exploited	Internal patching lags the perimeter
Remote Service Session Hijacking (T1563)	An existing RDP or SSH session taken over	Disconnected admin sessions left on servers
Lateral Tool Transfer (T1570)	Tools copied between internal hosts	File transfers nobody monitors
Software Deployment Tools (T1072)	Configuration Manager, Intune or an RMM platform used to push code	A console with Tier 0 power, not protected like Tier 0
Internal Spearphishing (T1534)	Phishing colleagues from a compromised mailbox	Internal mail trusted more than external
Taint Shared Content (T1080)	Malicious files planted on popular shares	Shares too many people can write to
Replication Through Removable Media (T1091)	Spreading on USB drives	Removable media allowed, often the gap into isolated networks

Pass the hash, pass the ticket and living off the land

Windows does not need your password to authenticate you remotely. NTLM proves knowledge of the hash, and Kerberos accepts a valid ticket, so an attacker who steals either can pass the hash or pass the ticket without cracking anything. MITRE’s mitigations target the root cause: credentials that work on too many machines. Rubeus is the tool most associated with ticket handling, and our explainer covers the Kerberos events that expose it. Forged tickets are the extreme form, covered in Golden Ticket and Silver Ticket attacks.

The execution side rarely involves malware: service creation over SMB, WMI, PowerShell remoting and RDP are administrator tools, so detection has to ask who is using them, from where, and what happens next.

Cloud and hybrid identity

ATT&CK’s Cloud Services sub-technique covers synced or federated on-premises identities used against cloud control planes (one documented example is Storm-0501, which abused a compromised Entra Connect Sync server). Direct Cloud VM Connections covers features such as Azure Serial Console and EC2 Instance Connect, which can grant SYSTEM or root on a VM. Treat the sync server as Tier 0 and use cloud-only admin accounts. Detection on this side comes from Entra ID sign-in logs and cloud audit logs: watch for the sync account or a synced administrator signing in from a new address, to a management portal it never uses, or without the device and MFA signals its normal sign-ins carry.

Lateral movement on Linux and over SSH

On Linux the loop is the same and only the material changes. ATT&CK tracks it as SSH (T1021.004) and SSH Hijacking (T1563.001). The reusable credential is usually a private key with no passphrase in a home directory, a key or password in a deployment script, or a forwarded SSH agent on a jump host, which anyone with root on that host can borrow. Shell history, SSH config files and known_hosts then show where the key works.

• Log sources. The sshd log (/var/log/auth.log or /var/log/secure, or the systemd journal) records each accepted login with the user, source address and key fingerprint. auditd adds what ran after the login (execve), reads of private key files and changes to authorized_keys.
• What to alert on. Server-to-server SSH between hosts that have never connected before, a service account opening an interactive session, one key fingerprint arriving from a new source, a new line in authorized_keys.
• Controls. MITRE lists three: disable the SSH daemon where it is not needed, require multi-factor authentication, and limit which accounts can log in. Add a bastion reached with ProxyJump in place of agent forwarding, passphrase-protected or hardware-backed keys (or short-lived SSH certificates), no key shared across environments, and host firewall rules that allow SSH only from the bastion.

Lateral movement detection

No single event says “lateral movement”. The signal is a sequence on the destination host: a network logon from an unusual source, then within minutes a new service, scheduled task or process launched by a remote-management host.

Behavior	Log source	Event IDs	What it means
Network logon from a new source	Destination Security log	4624 type 3; 4625 failures	A credential used remotely; first-time host pairs matter most
NTLM where Kerberos is expected	Destination; domain controllers; source	4624 with package NTLM; 4776; on the source, 4624 type 9 (logon process seclogo)	Possible pass the hash
Explicit credentials	Security log, source	4648	A process supplied another account’s credentials, the source-side half of a hop
Admin share access	File share auditing	5140, 5145	ADMIN$ or C$ opened, often to drop a file
Remote service or task created	System and Security logs	7045, 4697; 4698	Service- or task-based execution, the PsExec pattern
Process started by WMI or WinRM	Security log, Sysmon, PowerShell Operational	4688 or Sysmon 1 with parent WmiPrvSE.exe or wsmprovhost.exe; 4104	Remote command execution, and what it ran
RDP session	Security; TerminalServices logs	4624 type 10; 4778, 4779; 1149; 21, 24, 25	Remote interactive logon; odd reconnects can mean hijacking
Credential theft first	Sysmon	10 (access to lsass.exe)	LSASS memory read, usually just before pass the hash
Peer-to-peer admin traffic	Firewall or NetFlow	None	Workstation-to-workstation SMB, RPC, WinRM or RDP should be rare

Several of these need audit policy changes first: by default Windows does not log process creation (4688; its command line is a separate setting), file share access (5140, 5145), scheduled task creation (4698), service installs in the Security log (4697) or RDP reconnects and disconnects (4778, 4779). Full script block logging must be enabled, and Sysmon is a separate free install.

Behavior beats single events: one account authenticating to dozens of hosts in minutes, a Domain Admin logging on to a workstation, or a service account logging on interactively is worth an alert by itself. CISA and NSA list insufficient internal network monitoring among their top ten misconfigurations, next to lack of segmentation and poor credential hygiene.

How to detect lateral movement on the network

Host logs show what happened on a machine. Network data shows the movement between machines, including the ones with no agent and no log forwarding. Four sources are worth having:

• East-west flow baselines. Collect NetFlow, IPFIX or internal firewall logs between VLANs, and inside them where the switches allow. Baseline which hosts talk on TCP 445 (SMB), 135 (RPC), 5985 and 5986 (WinRM), 3389 (RDP) and 22 (SSH), then alert on new pairs. Two patterns matter most: workstation to workstation, and one source reaching many destinations within minutes.
• A network sensor on a core mirror port. Zeek or Suricata parses SMB, DCE/RPC, Kerberos and NTLM, so you can see remote service creation and scheduled task calls over RPC, writes to ADMIN$ and C$, and NTLM logons where Kerberos is normal, even when the endpoints log nothing.
• Identity monitoring on domain controllers. Every hop authenticates somewhere. Microsoft Defender for Identity, for example, groups its alerts by attack phase and has a lateral movement category alongside reconnaissance and credential access.
• Deception. A honeytoken account that looks privileged and is never used, a decoy file share, a decoy host with no business purpose. Nothing legitimate touches them, so any logon attempt or connection is a high-confidence alert with almost no tuning.

Network detection has one hard limit: it shows that host A opened an administrative session to host B, not what ran. Join it to the destination-side events in the table above to get the full sequence.

How to prevent lateral movement

Control	What it breaks	Caveat
Windows LAPS for unique local admin passwords	One local admin hash opening every workstation	Built in since April 2023; broad read rights on the passwords become a path of their own
Deny network logon to local accounts; keep domain users out of local Administrators	Pass the hash with local accounts	Document break-glass exceptions
Tiered administration (Microsoft’s enterprise access model)	Privileged credentials left on user devices	Domain Admins never log on to workstations
Protected Users for privileged people	NTLM, credential caching, delegation	Kerberos with AES only; never add service or computer accounts
Credential Guard	Theft of NTLM hashes and TGTs from memory	On by default on eligible domain-joined Windows 11 22H2+ Enterprise and Education devices and Windows Server 2025 member servers, not domain controllers; does not protect Kerberos service tickets or local accounts
Authentication policies and silos for Tier 0 accounts	Privileged credentials used from any host other than designated admin workstations	Needs Kerberos armoring on the hosts involved; run the policy in audit mode before enforcing it
Remote Credential Guard or Restricted Admin for RDP	Credentials left on the server you connect to	Prefer Remote Credential Guard; Restricted Admin lets a stolen hash log on over RDP, so keep it to helpdesk use
Host firewall rules blocking workstation-to-workstation SMB, RPC, WinRM and RDP	Peer-to-peer movement	A CISA and NSA recommendation; administer through jump hosts
Required SMB signing, LDAP signing and channel binding, LLMNR and NBT-NS off	Relay and name poisoning	Windows Server 2025 requires SMB signing only outbound, so member servers accept unsigned sessions by default
Segmentation of user, server, management and backup zones, with microsegmentation around critical servers	Reach to the systems that matter	Does not stop identity-based movement inside a zone

Our Active Directory hardening checklist turns these into 40 verifiable checks. Segmentation is easy to assume from a diagram and rarely tested from the wrong side; network segmentation testing proves it, as PCI DSS 11.4.5 requires when segmentation reduces scope.

How Invadel tests for lateral movement

An internal penetration test is a lateral-movement test by design. We start from a standard domain user on one workstation, usually through a small appliance or virtual machine you host. Senior in-house testers map the paths, check where each credential works, and move only inside the rules of engagement: credential checks paced under the agreed lockout limits, fragile systems handled as agreed in writing, and the path past any boundary you set documented rather than taken.

The report shows each hop as a finding with its proof, mapped to MITRE ATT&CK and ranked by the fixes that close the most paths, with a timeline your defenders can replay against their alerts to see what should have been detected and when. Every engagement includes a free retest of remediated findings, an attestation letter and the findings platform; the sample report shows the format.

Question you need answered	Engagement	Starting price
How far does one compromised user get?	Internal network penetration test	$6,000 for one domain up to a few hundred hosts; $9,200 Medium; $14,500+ Large
How many paths lead from a standard user to Domain Admin?	Active Directory security assessment	$6,000 for one domain; multi-domain quoted
Can lower-trust networks reach a protected zone?	Network segmentation testing	From $6,000 with an internal test
Could ransomware spread and reach the backups?	Ransomware readiness assessment	$6,000
Would your SOC detect and stop a real operator?	Red team	$12,500
Which detections fire, technique by technique?	Purple team assessment	Quoted

Prices are fixed in writing from your scope, with no sales call; onboarding begins within 24 hours of a signed proposal, and the price calculator adds up several tests.

Frequently asked questions

What is an example of a lateral movement attack? In CISA’s Akira ransomware advisory, attackers who got in through a VPN without multifactor authentication used RDP, SSH and remote-access tools to move between hosts. Internal tests often trace the same shape: one standard user, a shared local administrator password, a server with a Domain Admin logged on, then the domain controller.

What are the most common lateral movement techniques? In Windows networks, valid credentials used over SMB admin shares, WMI, WinRM and RDP, often with a stolen hash or Kerberos ticket in place of a password. In the cloud, synced identities and stolen tokens.

What is the difference between lateral movement and pivoting? Lateral movement is gaining control of another host. Pivoting is using a host you already control as a relay to reach network segments you cannot reach directly, usually by routing traffic through the attacker’s C2 channel. The two go together: pivot to reach a new subnet, then move laterally onto a host inside it.

How do you detect lateral movement on Linux servers? Start with the sshd log, which records every accepted login with its source address and key fingerprint, and alert on server-to-server SSH between hosts that have not connected before. Add auditd rules for command execution, private key reads and authorized_keys changes, and compare against east-west flow data for port 22.

Can EDR stop lateral movement? It helps against credential theft and known tooling, but valid credentials over administrator protocols look like administration. Running the techniques in an internal test or purple team exercise shows whether your correlation rules fire.

Does network segmentation stop lateral movement? It limits where an attacker can reach, but not movement inside a zone, and Active Directory usually spans every zone, so segmentation and credential hygiene work together.

How much does it cost to test for lateral movement? An internal network penetration test starts at $6,000 for one Active Directory domain of up to a few hundred hosts, fixed in writing before testing begins, with a free retest of the fixes.

The short version

Lateral movement is where one stolen credential becomes many, one remote-management hop at a time. Unique local passwords, tiered administration, Credential Guard, peer-to-peer firewall rules and tested segmentation stop most of it; correlating logons with what follows catches the rest. An internal network penetration test shows how far it gets in your network, fixed from $6,000 with a free retest. Scope yours here.