What is lateral movement?

What is lateral movement?

Lateral movement is what an attacker does after the first foothold: moving from the initially compromised machine to other systems inside the network until reaching the ones that matter, such as domain controllers, file servers, backup systems and email. The first victim is usually an ordinary workstation, reached through a phishing email or an exposed service. The valuable data and administrative control are elsewhere, so the attacker has to travel.

MITRE ATT&CK lists Lateral Movement as its own tactic, TA0008. It usually alternates with credential access and privilege escalation: compromise a host, harvest credentials there, use them to reach the next host, and repeat.

Common lateral movement techniques

• Remote services with stolen credentials: RDP (TCP 3389), SMB admin shares such as C$ and ADMIN$ (TCP 445), Windows Remote Management (TCP 5985 and 5986) and SSH (TCP 22).
• Pass-the-hash and pass-the-ticket: credential dumping tools such as Mimikatz pull NTLM hashes or Kerberos tickets from memory, and the attacker presents them to other systems without ever learning the password.
• Remote execution tools: PsExec, WMI and scheduled tasks created on remote machines.
• Exploiting internal services: the WannaCry worm spread in 2017 through the EternalBlue exploit against SMBv1.
• Abusing management tools: remote monitoring and management (RMM) software and software deployment systems that already reach every endpoint.

Most of these are legitimate administration methods, which is why lateral movement often counts as living off the land and slips past signature-based antivirus.

What lateral movement looks like in logs

A finance workstation authenticating to several servers within seconds at 2 a.m., with a service account that normally runs only on the backup server, is a classic pattern: a burst of network logons (type 3), NTLM where Kerberos is expected, and a new PsExec service. Other signs include workstation-to-workstation SMB or RDP traffic, an account logging on to far more hosts than usual, and unexpected east-west traffic between segments.

Detecting and limiting lateral movement

• Segmentation and microsegmentation, so a compromise in one zone doesn't reach every server, plus host firewalls that block workstation-to-workstation SMB and RDP.
• Unique local administrator passwords, for example with Microsoft LAPS, so one harvested password doesn't open every machine.
• Tiered administration and privileged access management, so domain admin credentials are never used on ordinary workstations where they can be dumped.
• MFA on remote access and administrative logons, and restricting NTLM where possible.
• EDR and SIEM correlation that alert on unusual authentication patterns, plus deception such as honeytokens and canary accounts that no legitimate user should ever touch.

During incident response, containment exists largely to stop lateral movement: isolate affected hosts from the network, disable compromised accounts and block the attacker's tools before eradication.

Lateral movement vs. privilege escalation

Privilege escalation gains higher rights, such as going from a standard user to local administrator or domain admin. Lateral movement reaches more systems. Attackers alternate the two, but an attacker who gained administrator rights on the same server escalated privileges, while one who used those credentials to log on to other servers moved laterally. Penetration testers use the closely related term pivoting for routing through a compromised host to reach systems behind it.

Lateral movement on the CompTIA Security+ exam

SY0-801 objective 2.3 treats lateral movement as a stage that intrusions chain after initial access, objective 2.5 tests its indicators, such as pass-the-hash and one host spreading to others, and objective 4.7 covers the containment that stops it during incident response. Wording such as "moved from the compromised workstation to the file server", "east-west traffic", "used harvested credentials on other hosts" or "spread laterally" points here. Segmentation and microsegmentation are the usual best mitigation; an IDS can see lateral movement but doesn't stop it, and encryption protects data in transit without limiting which hosts can connect. Distractors include privilege escalation, which raises rights rather than reach, and data exfiltration, which moves data out of the network rather than across it.