Lateral Movement Techniques

Lateral movement encompasses the techniques adversaries and authorized penetration testers use to progressively expand access across a network after establishing an initial foothold. This reference covers the definition and classification of lateral movement within offensive security methodology, the mechanisms through which it operates, the scenarios in which practitioners apply it, and the decision criteria that distinguish one approach from another. Understanding this phase is essential for organizations commissioning network penetration testing or red team operations, as it directly models the threat path attackers follow after bypassing perimeter defenses.

Definition and scope

Lateral movement refers to the set of techniques by which an attacker — or an authorized tester replicating attacker behavior — traverses a network from one compromised host to additional systems, gradually expanding the attack surface and approaching high-value targets such as domain controllers, databases, or sensitive data repositories. It is formally categorized within the MITRE ATT&CK framework under Tactic TA0008, which lists over 17 distinct technique categories covering credential access, remote service abuse, and internal network exploitation (MITRE ATT&CK, Lateral Movement Tactic TA0008).

Lateral movement is structurally distinct from both privilege escalation techniques and post-exploitation techniques, though the three often operate in sequence. Privilege escalation increases permission levels on a single host; lateral movement extends the attacker's geographic footprint across the network; post-exploitation encompasses persistence, data collection, and impact. Conflating these phases produces incomplete threat models and gaps in defensive coverage.

The scope of lateral movement in a penetration test is governed by the rules of engagement and authorization agreements. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment (csrc.nist.gov), identifies internal network traversal as a core component of penetration testing methodology, distinguishing it from perimeter-only assessments. PCI DSS v4.0 Requirement 11.4.1 explicitly requires penetration testing to include internal segmentation validation — a direct reference to lateral movement simulation (PCI Security Standards Council, PCI DSS v4.0).

How it works

Lateral movement follows a repeating cycle: reconnaissance of the local network segment, credential acquisition or token abuse, remote execution on a target host, and establishment of a new foothold from which the cycle restarts. MITRE ATT&CK documents this progression through the following technique categories:

  1. Pass-the-Hash (T1550.002) — Reusing captured NTLM hash values to authenticate to remote systems without knowing the plaintext password, common in Windows environments using legacy authentication protocols.
  2. Pass-the-Ticket (T1550.003) — Forwarding Kerberos ticket-granting tickets (TGTs) or service tickets to authenticate as a legitimate user across domain-joined systems.
  3. Remote Services abuse (T1021) — Leveraging protocols such as SMB, RDP, SSH, WinRM, and VNC to establish sessions on remote hosts using acquired credentials.
  4. Internal Spearphishing (T1534) — Sending malicious payloads or links from a compromised internal account to other users within the same organization, exploiting implicit trust.
  5. Exploitation of Remote Services (T1210) — Targeting unpatched vulnerabilities on internal hosts reachable from the initial compromised system; EternalBlue (MS17-010) is a historically documented example.
  6. Lateral Tool Transfer (T1570) — Moving attack tools, scripts, or payloads across hosts using native file-sharing mechanisms such as SMB shares or cloud storage sync.
  7. Use of Alternate Authentication Material (T1550) — Abusing tokens, certificates, or application-specific credentials to pivot without triggering standard password-based authentication alerts.

The Metasploit Framework provides modules for several of these techniques, including SMB relay attacks and token impersonation, and is widely used in authorized engagements to validate lateral movement paths.

Credential material acquisition typically precedes traversal. Tools such as Mimikatz extract NTLM hashes and Kerberos tickets from Windows LSASS memory. BloodHound maps Active Directory relationships to identify the shortest privilege path between a compromised user and a Domain Admin account, reducing the number of hops required.

Common scenarios

Lateral movement surfaces across multiple penetration testing engagement types. The following represent the most operationally significant scenarios:

Internal network assessments — In a standard network penetration testing engagement, a tester who achieves an initial foothold on a workstation uses lateral movement to determine whether network segmentation controls actually prevent traversal to server segments, OT networks, or cloud-connected systems. Failures here directly violate PCI DSS segmentation requirements.

Active Directory environments — Windows domains present the most complex lateral movement surface. Kerberoasting, AS-REP Roasting, and DCSync attacks target Active Directory authentication infrastructure. The National Security Agency (NSA) and CISA jointly published Detecting Abuse of Authentication Mechanisms (CISA AA21-008A) to address exactly these attack patterns in federal environments.

Red team operations — Full-scope red team operations incorporate lateral movement as a mandatory phase, with testers expected to traverse from an initial access vector (phishing, physical, or external exploitation) through internal systems and ultimately reach the defined crown-jewel objective. The depth and breadth of traversal distinguishes red team engagements from narrower penetration tests.

Cloud and hybrid environments — In hybrid architectures, lateral movement extends from on-premises Active Directory into Azure AD or AWS IAM through federated identity trust relationships. CISA's Cloud Security Technical Reference Architecture (CISA CTRA) identifies identity federation abuse as a primary lateral movement vector in cloud-connected enterprises. Cloud penetration testing engagements specifically model this attack path.

Healthcare and critical infrastructure — In healthcare environments subject to HIPAA Security Rule requirements (45 CFR §164.308), lateral movement toward electronic protected health information (ePHI) stores represents the highest-risk traversal path. SCADA and ICS environments present a separate scenario where lateral movement from IT networks into operational technology segments can have physical consequences, subject to ICS-CERT guidance.

Decision boundaries

Selecting which lateral movement techniques to include in an authorized engagement depends on four primary factors:

Authorization scope — The rules of engagement must explicitly authorize internal traversal. Techniques such as Pass-the-Hash involve actively abusing production authentication infrastructure; without written authorization, this constitutes unauthorized access under 18 U.S.C. § 1030 (the Computer Fraud and Abuse Act). Rules of engagement documentation must specify permitted techniques, excluded systems, and credential handling protocols.

White-box vs. black-box posture — In black-box testing, the tester begins with no internal knowledge and must discover lateral movement paths organically; this produces higher realism but longer timelines. In white-box engagements, network diagrams and Active Directory exports accelerate the identification of traversal paths. Gray-box testing, the most common commercial configuration, provides partial information such as a domain user account but no administrative credentials.

Network architecture maturity — Flat networks with no segmentation allow unrestricted lateral movement and require little technique sophistication to traverse. Segmented environments with enforced micro-perimeters require testers to identify jump hosts, exploit misconfigured firewall rules, or abuse dual-homed systems. The technique selection shifts accordingly: SMB relay attacks are most effective on flat networks, while identity federation abuse becomes the primary vector in segmented environments.

Destructiveness threshold — Certain lateral movement techniques carry operational risk. DCSync replication requests generate detectable domain controller traffic; exploiting EternalBlue on a production host risks system instability. Penetration testing methodology frameworks such as the Penetration Testing Execution Standard (PTES) define risk tiers for techniques, and engagement contracts should specify whether testers are authorized to use techniques above a defined impact threshold.

Lateral movement simulation produces the most operationally meaningful findings when it is scoped to replicate realistic adversary behavior rather than exhaustively enumerate every possible traversal technique. The penetration testing methodology governing an engagement determines which of these decision criteria apply and how findings are documented in the final report.

References

📜 2 regulatory citations referenced  ·  🔍 Monitored by ANA Regulatory Watch  ·  View update log

Explore This Site

Regulations & Safety Regulatory References Tools & Calculators Password Strength Calculator