Lateral Movement

After the initial compromise of a host, the attacker typically performs internal reconnaissance to learn its location in the network and the network's structure. It then tries to compromise more hosts and escalate its privileges, aiming to gain control of a target such as a domain controller, a critical system, or sensitive data. Any credentials it collects give it what appears to be legitimate access to more hosts and servers.

MITRE ATT&CK treats lateral movement as a tactic (TA0008). Adversaries may install their own remote access tools or use legitimate credentials with native network and operating system tools, which may be stealthier. Techniques under the tactic include logging in to remote services with valid accounts, exploiting remote services, and hijacking existing remote service sessions.

A network with strong boundary protection but no internal security lets an attacker traverse the network freely once inside. NCSC guidance on preventing lateral movement covers protecting credentials, good authentication practices, protecting high privilege accounts, least privilege, locking down devices, network segmentation, and network monitoring.

Segmentation separates systems and data that do not need to communicate, so the attacker's point of entry may have no means of reaching the target data or system. Monitoring matters because a determined attacker will eventually gain access, and monitoring the network is the only way to identify the breach and react.