Lateral Movement Techniques
Lateral movement describes the set of techniques adversaries use to progressively expand access across a network after establishing an initial foothold. The discipline is central to penetration testing engagements because it reflects how real-world threat actors operate inside enterprise environments — not through a single catastrophic exploit, but through a chain of incremental privilege escalations and pivots. Understanding the classification, mechanics, and operational boundaries of lateral movement is essential for security professionals evaluating detection coverage, scoping red team exercises, and interpreting findings from penetration testing engagements.
Definition and scope
Lateral movement is formally catalogued by MITRE in the ATT&CK framework under Tactic TA0008, defined as techniques that enable adversaries to access and control remote systems within a network. The scope encompasses credential reuse, protocol abuse, trust exploitation, and session hijacking — distinct from initial access (TA0001) and privilege escalation (TA0004), though frequently chained with both.
The legal boundary separating authorized lateral movement simulation from unauthorized intrusion is drawn by the Computer Fraud and Abuse Act (18 U.S.C. § 1030). Any lateral movement activity in a penetration test must occur within a documented rules-of-engagement authorization, specifying the target IP ranges, credential assets in scope, and actions permitted on compromised hosts.
Regulatory frameworks driving demand for lateral movement simulation include:
- PCI DSS v4.0, Requirement 11.4.1 — mandates penetration testing that validates segmentation controls, which directly tests the feasibility of lateral movement between cardholder data environment segments (PCI SSC)
- NIST SP 800-53 Rev. 5, CA-8 — establishes penetration testing as a control for assessing security architecture, including internal network traversal (NIST)
- CMMC 2.0, Level 2 — references NIST SP 800-171 assessment procedures, which include internal threat simulation consistent with lateral movement testing (DoD CMMC)
How it works
Lateral movement proceeds through a structured sequence of reconnaissance, credential acquisition, and host-to-host traversal. MITRE ATT&CK documents over 30 distinct sub-techniques under TA0008; the core operational phases map as follows:
- Internal reconnaissance — After initial access, the adversary enumerates active hosts, open ports, domain structure, and trust relationships using tools such as
net view,nltest, or LDAP queries against Active Provider Network. - Credential harvesting — Credentials are extracted from memory (e.g., via LSASS process access), from local credential stores, or through token impersonation. Mimikatz-style techniques target NTLM hashes and Kerberos tickets.
- Authentication relay or reuse — Harvested credentials are applied to remote systems using protocols including SMB, RDP, WinRM, or SSH. Pass-the-Hash and Pass-the-Ticket attacks use cryptographic credential material without requiring plaintext passwords.
- Remote execution — Commands or payloads are executed on target hosts via PsExec, WMI, DCOM, or scheduled tasks — all documented under ATT&CK sub-techniques T1021.002, T1047, and T1053.
- Persistence establishment — Footholds on newly accessed hosts are stabilized before further traversal, typically by deploying backdoors or creating local administrator accounts.
- Iterative pivot — The cycle repeats from each newly compromised host, progressively approaching high-value targets such as domain controllers, database servers, or backup infrastructure.
The contrast between Pass-the-Hash (PtH) and Pass-the-Ticket (PtT) illustrates the protocol dependency of lateral movement techniques. PtH applies to NTLM authentication and requires only an NT hash; PtT exploits Kerberos and requires a valid TGT or service ticket. PtH is blocked by disabling NTLM and enforcing Kerberos-only environments, whereas PtT requires mitigations at the Kerberos delegation and ticket-lifetime configuration level.
Common scenarios
Lateral movement appears across three primary penetration testing engagement contexts:
Internal network penetration tests — Testers placed inside a corporate LAN, simulating a compromised endpoint, pivot toward domain controllers and sensitive file shares. This scenario validates whether network segmentation controls identified under PCI DSS Requirement 11.4 actually contain a breach.
Red team exercises — Multi-phase adversary simulations, often following TIBER-EU or CBEST threat intelligence-led frameworks, use lateral movement as a core phase to test detection and response capabilities of a security operations center. The objective is not just access but dwell time and data exfiltration simulation without triggering alerts.
Active Provider Network compromise simulations — Kerberoasting (ATT&CK T1558.003) and AS-REP Roasting target service account credentials obtainable from any domain-authenticated user. BloodHound, an open-source Active Provider Network enumeration tool maintained as a community project, graphs attack paths from low-privilege users to Domain Admin — providing a data-driven map of lateral movement feasibility across an environment.
Decision boundaries
The penetration testing provider network organizes engagements partly by the scope boundary decisions that govern lateral movement testing. Three decision axes define how this technique class is scoped:
Authorized vs. prohibited targets — Rules of engagement must explicitly list systems accessible via lateral movement. Production databases, OT/ICS networks, and third-party hosted environments are commonly excluded, requiring testers to halt traversal at defined perimeter hosts.
Simulated vs. executed exploitation — Some engagements authorize full credential extraction and active host compromise; others limit testing to demonstrating the feasibility of a technique without executing payloads. NIST SP 800-115 Section 5.4 distinguishes between full exploitation and non-damaging proof-of-concept validation.
Black-box vs. assumed-breach — Black-box internal tests begin with a single low-privilege credential or endpoint, requiring testers to generate lateral movement opportunities organically. Assumed-breach tests supply testers with domain credentials or a pre-compromised host, focusing scope on detection response rather than initial access. The resource overview covers how these engagement types map to different organizational security maturity levels.
Practitioners selecting lateral movement testing approaches should reference MITRE ATT&CK TA0008 for technique coverage mapping, NIST SP 800-115 for assessment methodology framing, and engagement-specific authorization documents aligned to applicable regulatory requirements.