Lateral Movement Explained: Techniques and Detection for CySA+

Lateral movement is how an attacker gets from wherever they landed to wherever they wanted to be. The first compromised machine is almost never the objective — it is a receptionist's laptop, and the target is a file server, a database or a domain controller.

This article covers the movement itself and how to detect it. For the proxy and tunnelling mechanics that carry it, see the companion article linked at the end.

Why it matters more than initial access

Initial access will eventually succeed. Someone will click something, a credential will be reused, an internet-facing service will be unpatched.

What determines whether that becomes a breach is whether the attacker can move. A foothold on an isolated workstation with no reusable credentials and no reachable neighbours is an incident; the same foothold on a flat network with a cached domain administrator token is a catastrophe.

This is the argument for segmentation, tiered administration and zero trust, and it is why detection in this phase is worth more than detection at the perimeter.

The prerequisite: credentials

Most lateral movement runs on valid credentials rather than exploits, which is precisely what makes it hard to detect.

Attackers obtain them by dumping them from memory on the compromised host, harvesting cached domain credentials, finding them hard-coded in scripts and configuration files, capturing them through network coercion techniques, or simply reusing a password found in a breach corpus.

Once they hold a valid credential, subsequent activity is authenticated, logged as that user, and looks like administration.

The techniques

Remote services. Using legitimate remote access — RDP, SSH, SMB administrative shares, WinRM — with stolen credentials. The most common route, because it is indistinguishable from legitimate work at the protocol level.

Pass-the-hash and pass-the-ticket. Authenticating with the hash or Kerberos ticket rather than the password, so cracking is unnecessary.

Remote execution tooling. Administrative utilities and WMI used to run commands on other hosts.

Living off the land. Using tools already present — PowerShell, WMI, scheduled tasks, built-in administrative binaries — rather than bringing malware. Nothing to detect by signature, which is why behavioural detection matters here.

Internal spear phishing from a compromised mailbox, which is far more convincing than external phishing.

Shared infrastructure abuse. Deployment tools, management platforms and hypervisors reach everything by design, which makes them extremely valuable to compromise.

Kerberoasting. Requesting service tickets for accounts with service principal names and cracking them offline. Effective because service accounts often have weak passwords set years ago and never changed.

Detection signals

What a SOC should be watching for, and the part CySA+ tests hardest.

Workstation-to-workstation traffic. Workstations rarely have legitimate reason to connect to each other on SMB, RDP or WinRM. This is one of the highest-value detections available and one of the most commonly missing.

Authentication anomalies. An account authenticating to systems it has never touched, at unusual hours, or to an unusual number of hosts in a short window.

Service accounts behaving interactively. A service account logging in at a console is almost never legitimate.

Administrative tooling on unusual hosts. Remote execution utilities appearing on a machine where no administrator works.

Unusual PowerShell and WMI activity, particularly encoded commands or remote invocation — which is why script block logging is worth enabling.

Kerberos anomalies. Bursts of service ticket requests indicating Kerberoasting; tickets with unusual lifetimes or encryption types indicating forgery.

New scheduled tasks or services created remotely.

The unifying idea is that lateral movement is normal activity in an abnormal pattern. Detection therefore depends on knowing what normal looks like — which means baselining, and means east-west visibility rather than only perimeter monitoring.

Limiting it

Network segmentation and microsegmentation, so a foothold reaches very little.

Host firewalls blocking workstation-to-workstation traffic, which is cheap and remarkably effective.

Tiered administration. Never use privileged credentials on lower-trust systems, because doing so leaves credential material there. This single practice defeats a large share of real intrusions.

LAPS so local administrator passwords are unique per machine and one recovered hash does not open the estate.

Credential Guard and disabling WDigest to protect credentials in memory.

Just-in-time and just-enough administration, so standing privilege does not exist to be stolen.

Strong, long, managed passwords on service accounts, which is the answer to Kerberoasting.

What to remember

Lateral movement turns a foothold into a breach, and it mostly runs on valid credentials rather than exploits — which is why it looks like legitimate administration. Living off the land defeats signature detection. The highest-value detections are workstation-to-workstation connections, accounts authenticating where they never have before, and service accounts logging in interactively. Segmentation and tiered administration are the controls that matter most.

Related reading: Proxies and pivoting · Credential dumping · Threat scope reduction