What Is Lateral Movement? How Attackers Navigate Your Network

How Lateral Movement Works Technically

Lateral movement begins after an attacker has established initial access to a network. That initial foothold — a compromised endpoint, a phished credential, a vulnerable internet-facing system — is rarely the target the attacker is after. It is the starting point for navigating toward the systems that actually hold what the attacker wants: the domain controller, the backup infrastructure, the financial systems, the sensitive data repositories.

The technical methods of lateral movement fall into several categories. Pass-the-Hash uses captured NTLM credential hashes to authenticate to other systems without needing the plaintext password. Because Windows authentication allows NTLM hash-based authentication in many configurations, an attacker who extracts a credential hash from one system can authenticate to other systems on the network as that user without ever knowing the actual password. Pass-the-Ticket uses stolen Kerberos tickets — the authentication tokens that Windows domain environments use for single sign-on — to access network resources. A Kerberos ticket extracted from a compromised system's memory is valid for the duration of its lifetime, typically 10 hours, giving the attacker a window to access any resource the legitimate user could access.

Kerberoasting is an offline attack against Active Directory service account credentials. Service accounts in Active Directory can be configured with Service Principal Names (SPNs), which allows any authenticated domain user to request an encrypted Kerberos service ticket for that account. The attacker requests the ticket, captures it, and attempts to crack the encryption offline using GPU-accelerated brute force. If the service account has a weak password — which is common because service accounts are often configured once and never rotated — the attacker recovers the plaintext credential.

Living-off-the-land lateral movement uses legitimate Windows administrative tools — PsExec, WMI, PowerShell remoting, Remote Desktop Protocol — to move between systems. Because these are standard IT administration tools, their use generates activity patterns that are difficult to distinguish from legitimate administrative work without behavioral baselines that establish what normal looks like for a specific environment.

Why Lateral Movement Is the Phase That Determines Breach Scope

The scope of a security incident — how many systems are compromised, how much data is accessed, what the recovery cost is — is determined almost entirely by how far an attacker moves laterally before detection and containment. An attacker who is detected and contained on the first compromised endpoint causes limited damage. An attacker who moves laterally to the domain controller, compromises administrative credentials, and gains access to backup infrastructure causes an incident that may require complete environment rebuild.

This is why lateral movement detection is the security capability with the highest leverage for limiting incident cost. Not preventing initial access — initial access will occur despite preventive controls in mature threat environments — but detecting lateral movement quickly enough to contain the attacker before they reach high-value systems. Mean time to detect lateral movement is a more meaningful security metric than perimeter penetration rate for most organizations.

The Domain Controller: Why Attackers Target It

Active Directory domain controllers are the crown jewel target of lateral movement in Windows environments. The domain controller manages authentication and authorization for every system in the domain. An attacker who compromises the domain controller — through techniques like DCSync, which allows extraction of all credential hashes from Active Directory — effectively owns the entire domain. Every account's credentials can be extracted, every system can be authenticated to, and persistent access can be established that survives password resets and device reimaging. Ransomware groups specifically prioritize domain controller access because it enables simultaneous encryption of every domain-joined system from a single point of control.

Detecting and Preventing Lateral Movement

Lateral movement detection requires combining endpoint telemetry, authentication log analysis, and network traffic monitoring — because lateral movement generates signals in all three data sources that are individually ambiguous but collectively indicative of attack activity.

On the endpoint layer, EDR platforms configured with appropriate behavioral rules detect credential dumping attempts — processes accessing LSASS memory, execution of known credential harvesting tools, and suspicious use of administrative utilities from non-administrative users. The challenge is that many of these activities also occur during legitimate administrative work, requiring behavioral baselines that distinguish anomalous from expected activity in a specific environment.

In authentication logs — Windows Event Logs and Entra ID sign-in logs — lateral movement generates patterns including authentication from unusual source systems, pass-the-hash indicators, Kerberoasting ticket requests against service accounts with SPNs, and authentication to systems that a user account does not normally access. SIEM-based detection rules against these patterns provide visibility into credential-based lateral movement that endpoint telemetry alone may not catch.

Network segmentation is the architectural control that limits lateral movement scope regardless of detection effectiveness. If network segments are isolated such that a compromised workstation cannot directly connect to production servers, domain controllers, or backup infrastructure, an attacker must compromise each segmentation boundary separately — generating additional detection opportunities and limiting the blast radius of any single compromise. Most mid-market organizations have flat network architectures that provide no lateral movement resistance once initial access is achieved.

For PE operating partners assessing portco security, the lateral movement question is: if an attacker compromises a single endpoint today, how far can they move before hitting a segmentation control? In most mid-market environments, the honest answer is: all the way to the domain controller, unimpeded.

Related Reading

• Privilege Escalation
• Zero Trust Security
• Managed Detection and Response (MDR)

What is lateral movement in cybersecurity?

Lateral movement is the technique attackers use to move through a network after gaining initial access, expanding from the initially compromised system to additional systems, accounts, and resources. The goal is to reach high-value targets that are not directly accessible from the internet — domain controllers, financial systems, executive accounts, intellectual property repositories — by chaining together access between systems within the trusted network. Lateral movement is the phase where a contained incident becomes a company-wide breach.

How do attackers move laterally?

Common techniques include credential theft followed by re-authentication (Pass-the-Hash, Pass-the-Ticket, Kerberoasting), exploitation of trust relationships between systems (using compromised service accounts, exploiting domain trust relationships), abuse of legitimate administrative tools (PowerShell remoting, PsExec, WMI, RDP), exploitation of unpatched internal services (lateral movement through network vulnerabilities), and SSH or RDP brute-force against internal systems. Modern attackers combine multiple techniques to chain access from initial foothold to high-value target.

What is the difference between lateral movement and privilege escalation?

Privilege escalation increases the access level of an attacker on a single system — going from standard user to local admin to system. Lateral movement extends access to additional systems while typically maintaining a similar privilege level. Both are required to reach high-value targets: privilege escalation provides the authority needed to access sensitive data; lateral movement provides the breadth of systems where that data lives. Sophisticated attacks chain the two repeatedly.

How do you detect lateral movement?

EDR with behavioral detection catches the most common lateral movement techniques — PowerShell remoting from unusual sources, suspicious WMI activity, Pass-the-Hash attempts, anomalous service account authentication. Network traffic analysis identifies unusual east-west communication patterns. Identity platforms (Microsoft Entra ID Protection, Okta ThreatInsight) detect impossible-travel authentication and credential abuse patterns. The combination of endpoint and identity signals catches lateral movement that either source would miss alone.

How is lateral movement prevented?

Network segmentation that limits east-west communication between security zones is the primary architectural control. Privileged Access Management (PAM) for administrative credentials prevents harvested credentials from accessing the most sensitive systems. Disabling unnecessary administrative protocols (SMB v1, NetBIOS, NTLM where possible) eliminates lateral movement paths. Application of the principle of least privilege — standard users cannot access systems they do not need — reduces the value of compromised user credentials. Multi-factor authentication on internal systems blocks credential-based lateral movement.

What is the most common lateral movement technique?

Credential theft followed by legitimate authentication is the dominant technique. Attackers extract credentials from compromised endpoints (using Mimikatz, LaZagne, or built-in tools), then use those credentials to authenticate to additional systems through legitimate protocols (RDP, SMB, WMI, PowerShell remoting). The authentication appears legitimate because the credentials are valid — only behavioral signals (the source, the timing, the destination pattern) distinguish attacker use from legitimate use.

How does ransomware use lateral movement?

Modern ransomware operations rarely encrypt only the initially compromised system. After initial access, attackers spend days or weeks moving laterally to map the environment, identify high-value targets (backup systems, file servers, financial systems), establish persistence on multiple systems, and exfiltrate data for double-extortion. Only after broad lateral movement is complete is ransomware deployed simultaneously across the maximum number of systems. Stopping lateral movement before this stage is what distinguishes contained incidents from company-wide ransomware events.

NotPetya: Lateral Movement at Network-Destroying Speed

NotPetya, the destructive malware deployed against Ukraine in 2017 that spread globally to cause $10 billion in damages, used automated lateral movement to propagate through networks at machine speed. The malware used the EternalBlue exploit for initial spread, then deployed Mimikatz to extract credentials from memory on each compromised system, then used those credentials to authenticate to and infect additional systems via WMI and PsExec. It moved through flat, poorly segmented networks in minutes. Maersk, the global shipping company, lost control of 45,000 PCs, 4,000 servers, and 2,500 applications in under an hour. The recovery took 10 days, 45,000 new PCs, 4,000 new servers, and 2,500 reinstalled applications. The $300M recovery cost was entirely a function of the network architecture — flat, unsegmented, and providing no resistance to automated lateral movement.