Security Operations · Intermediate

Lateral Movement

Techniques attackers use to move from one compromised system to others within a network.

Definition

After initial access, attackers use stolen credentials and remote services such as RDP, SMB with PsExec, WinRM and WMI to pivot toward valuable targets. It corresponds to the Lateral Movement tactic (TA0008) in MITRE ATT&CK. Network segmentation, tiered administration and monitoring of authentication events (such as Windows logon type 3 and 10) help detect and limit it.

Related terms