Lateral movement is how an intruder gets from the first machine they compromise to the systems they came for. MITRE ATT&CK defines it as the "techniques that adversaries use to enter and control remote systems on a network" and tracks it as tactic TA0008. It is rarely an exploit. Most of it is signing in: a password, a password hash, a Kerberos ticket or a cloud token taken from one system and used on the next. The time around it is also shrinking. Mandiant's M-Trends 2026 measured the median hand-off from an initial access group to the follow-on group at 22 seconds in 2025, down from more than eight hours in 2022. That figure is the gap before the second group starts work, not the speed of movement between systems, but it means the people who will move through the network can begin almost at once. And on 30 October 2026 Google Threat Intelligence Group and Mandiant reported AI agent frameworks carrying out lateral movement in intrusions they investigated. Individual execution sequences of one of them, ARTEX, ran in bursts of roughly 2 to 25 seconds across the stages it handled.
This guide is written for the people responsible for a Windows and hybrid estate. It explains where lateral movement sits in an intrusion, the five paths it usually takes, what dated evidence from CISA, Mandiant, Microsoft, Google and Verizon shows, how an internal network penetration test or a red team engagement measures it, which events detect it and which fixes hold. It describes each technique at the level a defender needs to recognize it. It does not include attack commands or tool instructions.
Lateral movement at a glance
Question | Short answer |
|---|---|
What is it? | Moving from one compromised system or account to another inside the same environment. MITRE ATT&CK tracks it as tactic TA0008, with nine techniques in ATT&CK v20. |
What does it need? | Usually a credential, not a vulnerability: a reused password, a password hash, a Kerberos ticket, an SSH key or a cloud token. |
Where does it go? | From workstations to servers, toward domain controllers, backup and virtualization management, and from on-premises Active Directory into cloud identity. |
Why is it hard to see? | It uses the protocols administrators use every day (RDP, SMB, WinRM, SSH) with valid accounts. |
What does it leave behind? | Logon events on each destination (4624), explicit credential use (4648), NTLM and Kerberos events on domain controllers (4776, 4768, 4769), new services and scheduled tasks (4697, 4698) and east-west network connections. |
What limits it? | Unique local administrator passwords, administrative tiering, deny-by-default segmentation, credential protections and fast containment. |
How is it measured? | An internal network penetration test shows how far one foothold gets. A red team engagement shows whether anyone notices and how long containment takes. |
Where lateral movement sits in an intrusion
An intrusion almost never starts on the machine the attacker wants. It starts on the laptop of whoever opened the attachment, or on the server that happened to be unpatched. The file servers, databases, domain controllers, backup consoles and cloud tenant that hold the value are somewhere else. Lateral movement is the journey in between.
ATT&CK describes it in two sentences that are worth reading closely. Reaching the objective "often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it". And attackers may install their own remote access tools or "use legitimate credentials with native network and operating system tools, which may be stealthier". The second sentence is why this stage is so hard to see: nothing about a valid account opening a remote session is malicious on its face.
In practice lateral movement is a loop and not a single step. On each new system the attacker looks around (ATT&CK calls this Discovery, TA0007), takes whatever credentials the system holds (Credential Access, TA0006), signs in to the next system with them (Lateral Movement, TA0008) and, where the account they hold is too weak, finds a way to a stronger one (Privilege Escalation, TA0004). Every pass through the loop produces more credentials, which is why one compromised workstation so often ends with the whole domain.
Microsoft's Digital Defense Report 2026, which covers July 2025 to June 2026, puts numbers on the loop. In its review of Microsoft Defender Experts notifications, 52.2% of intrusions that began with valid accounts "involved follow-on credential theft", and the report's summary is that "one compromised identity fuels the compromise of many more". In the same intrusions, it adds, adversaries pivot through "Server Message Block (SMB) shares, Windows Management Instrumentation (WMI), and Remote Desktop Protocol (RDP)".
Three terms are often mixed up with lateral movement:
Privilege escalation is getting more rights. Lateral movement is getting to another system. They alternate, and techniques such as Kerberoasting are popular because one cracked service account can deliver both.
Pivoting means using a compromised host as a relay, so traffic to the next target appears to come from a trusted internal machine.
East-west traffic is traffic between systems inside the network. Lateral movement is east-west by definition, and that is where many monitoring programs are weakest.
The lateral movement techniques in MITRE ATT&CK
ATT&CK v20, released on 13 October 2026, lists nine techniques and 14 sub-techniques under Lateral Movement. The names and numbers below are ATT&CK's own.
ID | Technique | Sub-techniques |
|---|---|---|
Exploitation of Remote Services | None | |
T1534 | Internal Spearphishing | None |
Lateral Tool Transfer | None | |
Remote Service Session Hijacking | .001 SSH Hijacking, .002 RDP Hijacking | |
Remote Services | .001 Remote Desktop Protocol, .002 SMB/Windows Admin Shares, .003 Distributed Component Object Model, .004 SSH, .005 VNC, .006 Windows Remote Management, .007 Cloud Services, .008 Direct Cloud VM Connections | |
T1091 | Replication Through Removable Media | None |
Software Deployment Tools | None | |
T1080 | Taint Shared Content | None |
Use Alternate Authentication Material | .001 Application Access Token, .002 Pass the Hash, .003 Pass the Ticket, .004 Web Session Cookie |
Two things about this list help when you map detections or read a test report.
First, the list is narrower than everyday usage. Several things practitioners call lateral movement are filed under other tactics because they produce a credential and do not themselves move anywhere. Kerberoasting (T1558.003) and certificate abuse (T1649, Steal or Forge Authentication Certificates) sit under Credential Access. Valid Accounts (T1078), which almost every row above depends on, sits under Stealth, Persistence, Privilege Escalation and Initial Access. A report that only lists TA0008 techniques will understate how the tester actually got around.
Second, two rows matter more in a hybrid estate than their position suggests. T1021.007, Cloud Services, covers signing in to cloud services with accounts "that are synchronized with or federated to on-premises user identities". T1072, Software Deployment Tools, covers the management systems that can run code on everything at once, and ATT&CK's examples include "SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager".
The five main paths in a Windows and hybrid estate
The lateral movement findings in a penetration test report, and the cases in the advisories below, mostly follow one of five paths. Each is described here by what the attacker reuses, what the evidence says and how a defender recognizes it.
1. Credential reuse and local administrator sprawl
What it is. The same password working in more than one place. The classic case is a local administrator account created by an imaging process or a deployment script, with an identical password on every workstation. Close relatives are service accounts with administrator rights on many servers and passwords left in scripts, file shares and deployment tools.
Microsoft's own documentation for Windows LAPS states the problem in one sentence: "Local administrator accounts often share the same password across many devices, which bad actors can exploit to move laterally across your environment."
Evidence. During a threat hunt at a US critical infrastructure organization, published as advisory AA25-212A on 31 July 2025, CISA "identified a few local admin accounts with non-unique passwords; these accounts were shared across many hosts", with the credentials stored in plaintext in batch scripts. With the organization's permission, CISA used the credentials from one script to log in to a workstation and then open "a Remote Desktop Protocol (RDP) connection to another workstation", which it says "enabled lateral movement to any workstation with the account". In a public sector intrusion that Microsoft described in April 2026, the attacker ran a password spray from the first compromised server, "unlocking access to at least 14 servers through password reuse". For how spraying works on its own, see our guide to password spraying.
How a defender recognizes it. One local account logging on over the network to many machines in a short period. Administrator accounts logging on to ordinary workstations. Scripts in shared folders that create accounts or map drives with a password in them.
2. Pass the hash and pass the ticket
What it is. Windows single sign-on works by keeping credential material in memory after a user logs on, so the user is not asked for a password at every file share. ATT&CK's page on LSASS memory explains what that means for an attacker: the material "can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement". The attacker never needs the password itself.
Pass the hash (T1550.002) is, in ATT&CK's words, "a method of authenticating as a user without having access to the user's cleartext password". The stolen NTLM hash is presented in place of the password.
Pass the ticket (T1550.003) is "a method of authenticating to a system using Kerberos tickets without having access to an account's password". A ticket taken from one machine is replayed from another.
Overpass the hash combines the two: a stolen hash is used to obtain a valid Kerberos ticket.
The consequence is simple and uncomfortable. Every machine a privileged account logs on to becomes a place that account can be stolen from.
Evidence. Verizon's 2026 Data Breach Investigations Report found credential dumping from LSASS to be "one of the most common techniques found in both the threat intelligence dataset (34%) and the incidents dataset (20%)" in its analysis of privilege and credential access techniques, and lists "Tier Zero accounts logging into non-privileged systems" among the most common attack paths in the environments it examined. In CISA's red team assessment of a federal civilian agency (11 July 2024), server and domain administrators "occasionally shared the same jump hosts". The result, in CISA's words: "Once a domain administrator logged in, the red team stole the administrator's session token and laterally moved to a domain controller".
The same advisory shows that controls here do work: the agency's identity management system "blocked common credential manipulation techniques like pass-the-hash" and pass-the-ticket, which "hampered the red team's ability to pivot" and forced it onto other methods. In Google's October 2026 report, the ARTEX framework likewise attempted to reach domain controllers "using Pass-the-Ticket, WinRM, Kerberos relay, and Pass-the-Hash scripts", and the attempt ended when endpoint protection blocked execution and defenders cut off access to the server.
How a defender recognizes it. NTLM network logons from an account that normally uses Kerberos. A Kerberos ticket that appears on two machines. A privileged account authenticating from a host it has never used. Microsoft Defender for Identity has named alerts for both techniques, listed in the detection section.
3. Remote services: RDP, SMB, WinRM and SSH
What it is. The remote administration protocols themselves, used with valid accounts. ATT&CK's definition of Remote Services is plain: "Adversaries may use Valid Accounts to log into a service that accepts remote connections". Nothing is exploited. The attacker does what an administrator does, from a place an administrator would not.
Protocol | ATT&CK | How it is used to move | Dated example |
|---|---|---|---|
RDP | T1021.001 | An interactive desktop on the next machine | FBI, CISA and partners on Interlock (22 July 2025): the actors "leverage compromised credentials and Remote Desktop Protocol (RDP)" to move between systems |
SMB and admin shares | T1021.002 | A file copied to a hidden administrative share, then started through a remote service or scheduled task | CISA's red team (July 2024): "Internal pivots used SMB on port 445 and TCP bind listeners on ephemeral high ports" |
WinRM | T1021.006 | Remote PowerShell sessions | Microsoft, 2 September 2026: after a remote session granted to someone impersonating IT support over Microsoft Teams, the operator opened "WinRM connections over TCP port 5985 to domain-joined systems, including domain controllers and certificate authorities" |
SSH | T1021.004 | Key or password logon to Linux servers, network devices and hypervisors | CISA's red team (21 November 2024): SSH private keys "facilitated unrestricted lateral movement to other Linux hosts", including "two highly privileged accounts with root access to hundreds of servers" |
Management tooling belongs in the same family. In CISA's August 2026 advisory on two red team assessments, the team "moved laterally from the SCCM server to users' workstations", and CISA's conclusion is that "SCCM and other endpoint configuration managers (e.g., Jamf, BigFix) have broad administrative reach and are Tier 0 assets". Ransomware groups add commercial remote access tools on top: the Akira advisory, last revised on 13 November 2025, says the actors "use legitimate remote access tools like AnyDesk or LogMeIn" and also use RDP, SSH and MobaXterm.
How a defender recognizes it. Workstations opening SMB, RDP or WinRM sessions to other workstations. Remote sessions into servers from hosts that are not management workstations. WinRM started by a process that has no business administering anything, which is the signal Microsoft highlights in the September 2026 case. Our living off the land detection matrix covers the built-in tools involved.
4. Active Directory paths: delegation, AD CS and ACLs
What it is. Misconfigurations in Active Directory that let a low-privileged account become, or act as, a more privileged one. ATT&CK files most of these under Credential Access or Privilege Escalation, but they are what turns a foothold on one workstation into the right to sign in anywhere. Joint guidance on detecting and mitigating Active Directory compromises from the Australian Signals Directorate, CISA, the NSA and their Canadian, New Zealand and UK counterparts, revised in September 2026 (the Five Eyes guidance below), describes attackers using such weaknesses to "escalate their privileges, move laterally, and gain full control of the Active Directory domain".
Delegation. Delegation lets a server act on behalf of a user. With unconstrained delegation, the Five Eyes guidance explains, when a user authenticates to the server "a copy of the user object's TGT is stored" in the server's memory, so an attacker who controls that server can reuse the ticket of anyone who connects, including a domain administrator. CISA's November 2024 red team found that weak segmentation between the organization's Linux and Windows environments allowed SMB and Kerberos traffic to a domain controller and to "a domain server with Unconstrained Delegation enabled". In the August 2026 advisory, a service account's rights over a domain controller "enabled the team to conduct a resource-based constrained delegation attack, granting them DCSync privileges".
Active Directory Certificate Services (AD CS). A certificate can stand in for a password. The Five Eyes guidance describes a common template flaw, known as ESC1, as one that "allows any user object, regardless of their permissions, to request a certificate on behalf of any other user object (including privileged user objects) in the domain". CISA's red team found "multiple templates with an ESC1 misconfiguration" at one organization in 2026 and reports that the team "could then obtain certificates for any user account, providing means for lateral movement". M-Trends 2026 says attackers "are exploiting misconfigured Active Directory Certificate Services templates to create admin accounts that bypass password rotation".
Access control lists (ACLs). Every object in the directory has permissions, and over years they accumulate. At the second organization in CISA's 2026 advisory, one service account found through a cleartext password "had outbound object control over almost 1,000 accounts within the domain due to its group membership". Verizon's 2026 DBIR, working from attack graphs collected from organizations, found that "16% of organizations had about 80% exposure", which it defines as an attacker with low-level privileges having "an 80% or better chance of successfully compromising a key administrative account or infrastructure element".
How a defender recognizes it. Usually not from logs. These paths are found by reading the directory the way an attacker does, which is what an Active Directory security assessment is for. Our StingAD walkthrough shows a complete chain in a lab domain built to be vulnerable, and item 6 of our network vulnerabilities list covers AD CS in more depth.
5. Pivots between on-premises and cloud identity
What it is. In a hybrid estate, Active Directory and Microsoft Entra ID trust each other: accounts and password hashes synchronize, single sign-on carries a Kerberos logon into the cloud, and devices are joined to both. Each link is a path. Microsoft's guidance on protecting Microsoft 365 from on-premises attacks names the two main ones: "The two primary threat vectors are federation trust relationships and account synchronization. Both vectors can grant an attacker administrative access to your cloud."
Evidence. In August 2025 Microsoft described Storm-0501, a ransomware actor, compromising Entra Connect Sync servers and using their synchronization accounts to map the cloud tenant. The actor "identified a non-human synced identity that was assigned with the Global Administrator role in Microsoft Entra ID" that "lacked any registered MFA method", reset its on-premises password, let the change synchronize and registered an MFA method of its own. It then had to move between on-premises devices until it found a hybrid joined server that satisfied the tenant's Conditional Access policy, and from there it signed in to the Azure portal as a Global Administrator.
CISA's red team walked the same bridge at the second organization in its August 2026 advisory. It "looked for the on-prem server responsible for synchronization", obtained cleartext credentials for the synchronization accounts and signed in to the Azure portal. That interactive sign-in "triggered an automated alert from Microsoft" and the security team blocked the account. The red team then abused the organization's Seamless SSO configuration instead, which let it "gain access to Entra ID as any user synced to AD without the user's cleartext password", limited to accounts without MFA, which appeared to be service accounts. One synced account owned an application with permission to read, write and send email for all users. CISA's summary of the outcome is "the ability to retrieve the emails of every user within Organization B's environment from the public internet".
The Digital Defense Report 2026 treats this as normal now: "Hybrid attacks have become common in modern intrusions." After the pivot, it says, "lateral movement runs through identities and secrets (not RDP/WMI)", a useful correction for anyone who still pictures lateral movement only as RDP sessions.
How a defender recognizes it. An interactive sign-in by a synchronization or service account. A synced account with no MFA holding a cloud role or owning an application. New credentials added to an application registration. Sign-ins to cloud management portals from servers. Scoping the cloud side is covered in our guide to Azure and Entra ID penetration testing.
Evidence from 2024 to 2026
The same weaknesses appear in government red team reports, incident response data and vendor telemetry year after year. Every row links to its primary source.
Date | Source | What it reported |
|---|---|---|
11 July 2024 | Unsecured administrator credentials let the team "pivot freely throughout the Windows environment" to full domain compromise. Finding: "Internal servers could reach almost any other domain host". | |
21 November 2024 | "the DMZ was not properly segmented from the organization's internal domain". A domain controller fell about two weeks after initial access. | |
31 July 2025 | Shared local administrator passwords in plaintext scripts and weak separation of IT from operational technology. | |
27 August 2025 | A ransomware actor pivots from Active Directory to Entra ID through Entra Connect Sync servers. | |
23 March 2026 | Median hand-off from initial access to follow-on groups: 22 seconds in 2025. Global median dwell time: 14 days, up from 11. | |
17 April 2026 | In an intrusion that began in June 2025, password reuse opened at least 14 servers. | |
2026 edition | In 16% of organizations with attack graph data, a low-privileged attacker had an 80% or better chance of reaching a key administrative account or infrastructure element. | |
25 August 2026 | "In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources." | |
2 September 2026 | After a remote support session granted over Microsoft Teams, the operator pivots over WinRM toward domain controllers and certificate authorities. | |
30 October 2026 | AI agent frameworks carry out lateral movement in real intrusions. An attempt to reach domain controllers is blocked. |
Two patterns run through the table. Red teams keep reaching full domain compromise without anything exotic: a reused password, a cleartext credential, a misconfigured template, a flat network. And the gap is as much detection as prevention. In CISA's 2024 critical infrastructure assessment the organization "relied too heavily on host-based endpoint detection and response (EDR) solutions" and missed the team's activity in the Windows domain, while the same defenders caught movement in their Linux estate by analyzing NetFlow data and noticing an SSH key used "outside of preestablished baselines".
One advisory, two outcomes
CISA's August 2026 advisory is close to a controlled experiment: one red team, similar tradecraft, two organizations, at the same time.
Organization A | Organization B | |
|---|---|---|
First foothold | Phishing gave access to four workstations | Phishing gave access to three workstations |
First response | None. Alerts were raised and one was closed as a false positive | Staff isolated the three workstations "within 10, 2, and 20 minutes" |
What the red team did next | Carried on from its own foothold | Was given an internal host with a standard user account (an assumed breach) |
Path to the domain | A machine account quota left at its default and a misconfigured certificate template | A cleartext service account password on an SCCM distribution point, then that account's rights over a domain controller |
Lateral movement | From the SCCM server to the workstations of users with access to each target, then to every targeted business system "without defensive intervention" | To a business system, to a bastion host in the OT DMZ (detected and quarantined) and into Entra ID (first attempt detected and blocked) |
Outcome | Full domain compromise, cloud access, the SOC's own email read | Full domain compromise and cloud access, with the first foothold removed and two later moves stopped |
The first lesson CISA lists is "Untuned detection tools lead to missed threats." There is a second one in the table. Organization B detected and contained quickly, and that mattered: it removed the real foothold and stopped two later moves. But from an ordinary user account the directory still fell, because the weaknesses that carried the movement were configuration and credential hygiene, and those do not depend on how fast a SOC is. You need both halves.
How fast lateral movement happens now
The hand-off is gone. In 2022 the median gap between an initial access event and the hand-off to a second criminal group was more than eight hours. M-Trends 2026 puts it at 22 seconds in 2025 and explains why: initial access partners pre-stage the second group's tooling, so the follow-on operators "are fully equipped to launch operations the moment they first interact with the network". Mandiant's advice follows from that: "Treat routine malware alerts as high-priority indicators of an impending secondary intrusion".
Credentials go first. Microsoft's April 2026 analysis says that "in many real-world cases, domain-level credentials are compromised immediately following the very first access". In the case it describes, the attacker was creating a scheduled task on a domain controller within 24 hours.
AI agents compress the steps between. The Digital Defense Report 2026 lists, among the ways attackers now use AI, "Shortening the cycle of data exfiltration, secret discovery, and lateral movement from days to minutes". Google's ARTEX report gives a detailed account from incident response. Google and Mandiant observed "agentic activity conducting significant parts of the attack lifecycle (e.g., lateral movement, database exploitation, exfiltration preparation)", with individual ARTEX execution sequences running "in compressed bursts of roughly 2 to 25 seconds" between longer pauses. Mandiant's assessment in the same report is that such tooling "does not fundamentally change the techniques attackers use. It reduces the time required to combine them." Microsoft reports an actor it tracks as Storm-0940 using the same framework to go from initial targeting to privileged cloud access in less than 3 hours in multiple cases. Our analysis of ARTEX and agentic offensive frameworks separates what was observed from what was assessed.
Defenders are measured in minutes at best. The fastest human response in the sources above is Organization B's: 2 to 20 minutes to isolate a workstation after a medium-severity alert. Across Mandiant's 2025 investigations the global median dwell time was 14 days.
The conclusion is not that detection is pointless. It is that the controls which decide how far an intruder gets should not need a person to be fast. A unique local administrator password, a blocked workstation-to-workstation connection and a privileged account that never touches a workstation all work at machine speed.
How an internal network penetration test measures lateral movement
An internal network penetration test answers one question about lateral movement: starting from one ordinary position inside the network, how far can a skilled person get, and by which routes? It is a measurement of reach. The method below is what to expect from a competent provider, described without the commands.
What the tester starts with. Agree this before anything else, because it defines what the result means. The common starting points are:
A network connection and nothing else. A laptop or virtual machine on a user network segment, with no account. This shows what an intruder on the network can do before stealing any credential.
An assumed breach. A standard employee account on a standard workstation build, the position a successful phish gives away. This is the most efficient way to measure lateral movement, because testing time goes into the inside of the network and not into getting there. Our guide to assumed breach engagements explains when to choose it.
A specific zone. The guest Wi-Fi, a vendor VPN profile, a DMZ server or a factory network, when the question is what that zone can reach.
What "how far did one foothold get" looks like in a report. A list of vulnerabilities sorted by severity does not answer the question. Ask for the path:
Report element | What it should show |
|---|---|
Attack path narrative | Each hop from the starting point to the furthest point reached, in order |
Hop table | For every hop: source host, destination host, the account used, how that credential was obtained, the ATT&CK technique and the time |
Reach | How many hosts the starting account, and each recovered credential, could log on to or administer |
Shortest path to control | The fewest steps from an ordinary user to Domain Admin, or to whatever objective was agreed |
Chokepoints | The single account, host or setting whose fix breaks the most paths |
What was blocked | The hops that failed and the control that stopped them |
Segmentation testing. Segmentation is tested from each zone toward each zone it is supposed to be separated from, by attempting real connections across the full port range and comparing what answers with the documented rule set. The zones that matter most are the ones attackers go for: domain controllers, backup infrastructure, hypervisor and storage management, operational technology and cloud synchronization servers. Test both directions and retest after network changes. Item 7 of our network vulnerabilities list covers flat networks, and its summary applies here: segmentation does not stop the first compromise, it decides how far it spreads. CISA's 2025 threat hunt advisory recommends exactly this: "Regularly test segmentation controls to validate their effectiveness in restricting unauthorized access by conducting penetration testing and security assessments."
Credential hygiene findings. These are the findings that explain most of the reach, and they should be reported as a group so they can be fixed as a program:
Local administrator passwords shared across machines, and local accounts allowed to log on over the network.
Privileged accounts logging on to lower-tier systems, where their credentials can be taken from memory.
Passwords, keys and tokens in scripts, file shares, deployment tools, configuration files and user home directories.
Service accounts with weak passwords or more rights than the service needs.
Accounts and groups with unintended control over other objects in the directory.
Delegation settings, certificate templates and machine account quota left at risky values.
Synced accounts that hold cloud roles, and service accounts that sign in to the cloud without MFA.
In Stingrai's State of Penetration Testing 2026 dataset, internal network tests returned a median of 11 verified findings and 92% of them were rated High or Critical. Outdated or unpatched software made up 56.9% of internal network findings, misconfiguration and hardening 11.8% and authentication and session issues 8.6%. The first is the raw material for ATT&CK's Exploitation of Remote Services (T1210). The other two cover the credential and configuration weaknesses described above. For scope and cost, see the guides to internal penetration testing and Active Directory penetration testing services.
What a red team engagement adds: detection and containment time
A penetration test measures reach. A red team engagement measures whether anyone notices and what they do about it. The operators work covertly toward agreed objectives, and the deliverable that matters for lateral movement is a timeline: for each hop, whether it was prevented, logged, alerted on or missed, how long detection took and how long containment took.
Engagement | The question it answers about lateral movement |
|---|---|
Internal network penetration test | How far does one foothold get, and by which paths? |
Which identity paths exist in the directory, including the ones the tester did not need to use? | |
Red team engagement | Would we detect it, and how many minutes or days would containment take? |
Which specific techniques do our detections miss, and can we fix them while the testers are still here? |
CISA's two organizations show what a good answer looks like in practice: an alert that a person reads, clear authority to isolate a host, and a clock measured in minutes. They also show the failure mode. At Organization A, defenders discussed an alert on a management server, could not identify the system's owner and closed it as a false positive. Our detection and response benchmarks for red team exercises explain how to set targets for these intervals.
Questions worth putting to any provider before the work starts:
What is the starting position, and what does it represent?
Will the report show every hop with the account used and how it was obtained, or only the final result?
Is segmentation tested between named zones, and are management planes, backups and cloud synchronization servers in scope?
Will hybrid identity paths between Active Directory and Entra ID be tested, or does the test stop at the domain?
Is the security operations team told in advance, and will detection and containment times be recorded?
Is a retest of the fixed paths included?
How to detect lateral movement
Detection has to work with one awkward fact: most lateral movement is a valid account using a supported protocol. Tool names and file hashes catch the careless. What catches the rest is context: this account, from this host, to that host, at this time, has not happened before.
Start by making sure the events exist and reach a SIEM, from workstations as well as servers. CISA's 2025 threat hunt found that "the lack of workstation logs in the organization's SIEM meant CISA could not analyze authentication events to identify anomalous activities, such as unauthorized access using local administrator credentials".
Signal | Event and where it is logged | Why it matters |
|---|---|---|
A logon arriving over the network | 4624 on the destination, Logon Type 3 (Network) or 10 (RemoteInteractive, used for Remote Desktop) | Microsoft notes the event "generates on the computer that was accessed". The Source Network Address field shows where the session came from. A local account, as opposed to a domain account, arriving this way on many machines is the signature of a shared local administrator password. |
A process using different credentials for outbound connections | 4624 Logon Type 9 (NewCredentials) and 4648, "A logon was attempted using explicit credentials" | Shows one identity being used from inside another's session. 4648 also occurs in normal operation, so baseline it. |
A privileged session starting | 4672, "Special privileges assigned to new logon" | An administrative logon on a host where that account has no reason to be. |
NTLM authentication for a domain account | 4776 on domain controllers | Microsoft: on domain controllers "you can see all authentication attempts for domain accounts when NTLM authentication was used". NTLM for an account that normally uses Kerberos points to pass the hash. |
Kerberos ticket activity that does not fit | ATT&CK's detection strategy for pass the ticket correlates service ticket requests (4769) with "absent corresponding account logons (4624) and prior Ticket Granting Ticket (TGT - 4768) activity". | |
Remote execution through a service or task | 4697, "A service was installed in the system", and 4698, "A scheduled task was created" | A network logon followed shortly afterward by a new service or task on the same host is the classic pattern for movement over SMB. |
Access to administrative shares | 5140, "A network share object was accessed" | Microsoft's own example is to "monitor share C$ on domain controllers". |
Identity signals. Microsoft Defender for Identity raises named lateral movement alerts, including "Suspected identity theft (pass-the-hash)" (external ID 2017), "Suspected identity theft (pass-the-ticket)" (external ID 2018), where "a Kerberos ticket is seen used on two (or more) different computers", and "Suspected overpass-the-hash attack (Kerberos)" (external ID 2002). In the cloud, the detections that worked for Organization B were Entra ID risky user alerts for "Unfamiliar sign-in properties" and "Suspicious API traffic", plus Microsoft's automated alert on an interactive sign-in by a synchronization account.
Network signals. East-west traffic is where the 2024 critical infrastructure organization caught CISA's red team, through NetFlow analysis, and where it also had a gap: no intrusion detection or prevention system monitoring the DMZ at the network level. The patterns to look for are workstation-to-workstation SMB, RDP and WinRM, internal port scans, and, from Mandiant's guidance in the ARTEX report, "unexpected LDAP, Kerberos, NTLM, SMB, database, remote administration, and port-scanning activity originating from DMZ or internet-facing systems". CISA's advice from the same assessment is to "look for abnormal communications between workstations".
Three practical notes:
Build sequences, not single-event rules. ATT&CK's current detection strategies for RDP, SMB and WinRM are all chains: a remote logon followed within a short window by service creation, task scheduling or unusual process execution on the target.
Tune before you trust. Organization A had the alerts. In CISA's words, "The same red team activity that triggered alerts and action for Organization B led to no response for Organization A", because staff could not pick the real activity out of the alert volume.
Do not key on tool names. Movement through built-in protocols with valid accounts produces none.
Fixes that hold
The controls below are ordered by how much lateral movement they remove for the effort involved. None of them is new. What the 2024 to 2026 evidence adds is the reason to finish them: the gaps between them are now found in seconds.
Fix | What it removes | From the sources |
|---|---|---|
Unique local administrator passwords with Windows LAPS | One recovered local password working everywhere | Microsoft lists "Protection against pass-the-hash and lateral-traversal attacks" as the first benefit. CISA recommends LAPS by name in AA25-212A. |
Deny network logon to local accounts | Remote use of any local account that remains | Microsoft: this "helps to prevent lateral movement by making sure that attackers can't use stolen credentials for local accounts from a compromised operating system to compromise other computers". |
Administrative tiering | Privileged credentials being exposed on lower-trust systems | Five Eyes guidance: "Tier 0 user objects do not expose their credentials to lower tier systems." Tier 0 includes domain controllers, the AD CS root certificate authority, backup servers and the Microsoft Entra Connect server. |
Deny-by-default segmentation | Direct routes between systems that never need to talk | NSA and CISA: "Limit workstation-to-workstation communications." Mandiant's hardening guide lists SMB, RDP, WinRM and WMI as the protocols to block between workstations with the host firewall. |
Hashes and tickets readable from memory | It protects "NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials", and is on by default on eligible domain-joined devices from Windows 11 22H2 and Windows Server 2025. It "doesn't provide protections for the Active Directory database or the Security Accounts Manager (SAM)". | |
Protected Users for privileged accounts | NTLM, delegation and cached credentials for those accounts | Members cannot "Authenticate with NTLM authentication" or "Delegate with unconstrained or constrained delegation". Microsoft warns: "Never add accounts for services and computers to the Protected Users group." It also says not to add members of highly privileged groups "until you can guarantee that adding them won't have negative consequences", so test first. |
Restricted Admin or Remote Credential Guard for RDP | Credentials left behind on every server an administrator connects to | With Remote Credential Guard, "both credential and credential derivatives are never passed over the network to the target device". |
Service account hygiene | Roastable, over-privileged accounts with rights on many servers | Managed service accounts, long random passwords and least privilege, as set out in our Kerberoasting guide. |
Fix delegation and certificate templates | The directory shortcuts in path 4 | Five Eyes guidance: "Ensure computer objects are not configured for unconstrained delegation." Review AD CS templates and enrollment permissions. |
Separate cloud administration from on-premises identity | The pivot in path 5 | Microsoft: "No on-premises accounts should have administrative privileges in Microsoft 365." Five Eyes guidance: Entra Connect servers "need to be afforded the same security as Domain Controllers". |
Monitor east-west traffic and rehearse containment | Time | Decide in advance which hosts and accounts the SOC may isolate without approval, and measure it. |
Tiering is the control that makes the others stick. Credential Guard, Protected Users and LAPS each close one way of taking a credential, and tiering removes the credential from the place where it could be taken. The Five Eyes guidance points to Microsoft's Enterprise Access Model, and M-Trends 2026 extends the same thinking to infrastructure: "Virtualization and management platforms must be treated as Tier-0 assets with the strictest access constraints", and "backup environments should be decoupled from the corporate Active Directory domain".
Where Stingrai fits
Stingrai is a CREST-accredited penetration testing company offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters. It was founded in Toronto, Canada in 2021 and works with companies from startups to enterprises.
Lateral movement is measured in three of its engagements, and all three are human-led:
Internal network penetration testing. In the internal and external network penetration test, Stingrai's penetration testers work from an agreed starting position, test segmentation between zones and exploit findings in a controlled, non-destructive way, and the report shows how access moved from the first foothold toward domain administrator.
Active Directory security assessment. The Active Directory security assessment starts from an ordinary domain user and reports every path proved toward control of the directory, with the specific object and attribute behind each hop: Kerberos attacks, ACL and delegation abuse, coerced authentication, AD CS, Group Policy, trusts, credential exposure and the Tier 0 boundary.
Red teaming. Red team engagements run as assumed breach, full-chain or threat intelligence-led scenarios across Active Directory, Entra ID, AWS, Azure and Google Cloud. Detection and response timings are a contractual deliverable: every stage records what was prevented, logged, alerted or missed, and every engagement ends with a SOC replay and debrief.
The work is done by two named penetration testers from a team holding OSCE³, OSEP, CRTE, CRTO and CREST CRT certifications, with 18 published CVEs across the team and a team lead with 16 years in penetration testing, red teaming and exploit development. Findings are posted to the PTaaS platform as they are confirmed, with remediation guidance, and a retest confirms the closed paths. Engagements run as one-time annual tests or as continuous programs. Network, Active Directory and red team work is scoped per engagement.
Lateral movement defender checklist
Deploy Windows LAPS to every workstation and server, and deny network logon to local accounts.
List where each privileged account logs on, and stop Tier 0 accounts logging on to anything that is not Tier 0.
Treat domain controllers, AD CS, Entra Connect, backup, hypervisor management and endpoint management servers as Tier 0.
Block SMB, RDP, WinRM and WMI between workstations with the host firewall, and allow them to servers only from management hosts.
Confirm Credential Guard is running on eligible devices, add human privileged accounts to Protected Users after testing, and use Restricted Admin or Remote Credential Guard for administrative RDP.
Search file shares, scripts and deployment tools for passwords, keys and tokens, and rotate what you find.
Remove unconstrained delegation and review certificate templates, enrollment rights and the machine account quota.
Make every cloud administrator account cloud-only with phishing-resistant MFA, and make sure no synced account holds a privileged cloud role.
Collect 4624, 4648, 4672, 4697 and 4698 from workstations and servers, and 4768, 4769 and 4776 from domain controllers.
Alert on workstation-to-workstation remote sessions, local accounts used over the network and interactive sign-ins by synchronization accounts.
Write down who may isolate a host or disable an account without approval, and time it in an exercise.
Have reach, segmentation and detection measured in your next internal network test or red team engagement, and retest the fixes.
Frequently Asked Questions
What is lateral movement in cybersecurity?
Lateral movement is the stage of an intrusion in which an attacker moves from the first system they compromised to other systems and accounts in the same environment, until they reach what they came for. MITRE ATT&CK tracks it as tactic TA0008 and defines it as the techniques adversaries use to enter and control remote systems on a network. It usually relies on stolen or reused credentials and standard remote administration protocols, not on software exploits.
What are the most common lateral movement techniques?
In Windows and hybrid environments the common ones are reuse of local administrator and other shared passwords, pass the hash and pass the ticket (ATT&CK T1550.002 and T1550.003), remote services such as RDP, SMB administrative shares, WinRM and SSH (T1021), abuse of software deployment tools such as SCCM (T1072) and pivots between on-premises Active Directory and cloud identity. ATT&CK v20 lists nine techniques and 14 sub-techniques under Lateral Movement.
What is the difference between lateral movement and privilege escalation?
Privilege escalation means gaining more rights, often on the same system. Lateral movement means reaching a different system. Attackers alternate between them: they take credentials from one machine, use them to reach another, and repeat until an account with enough privilege is exposed. Active Directory weaknesses such as Kerberoastable service accounts, misconfigured certificate templates and unconstrained delegation matter because they provide both at once.
How fast does lateral movement happen?
It is increasingly measured in minutes. Microsoft's Digital Defense Report 2026 says attackers are using AI to shorten the cycle of data exfiltration, secret discovery and lateral movement from days to minutes, and Mandiant's guidance in Google's October 2026 ARTEX report says that with LLM-enabled tooling, credential discovery, permission testing, lateral movement and data access that previously required hours of operator effort can now occur in minutes. The step before it has all but disappeared: Mandiant's M-Trends 2026 measured the median hand-off from an initial access group to a follow-on group at 22 seconds in 2025, down from more than eight hours in 2022. Google and Mandiant reported in October 2026 that AI agent frameworks carried out lateral movement and other stages in intrusions they investigated, and that individual execution sequences of one framework, ARTEX, ran in bursts of roughly 2 to 25 seconds. That figure covers all of ARTEX's activity, not lateral movement alone. By comparison, the global median dwell time in Mandiant's 2025 investigations was 14 days.
How do you detect lateral movement?
Collect logon events from workstations and servers as well as domain controllers, and look for context that does not fit: event 4624 with Logon Type 3 or 10 from an unusual source, a local account logging on across many machines, NTLM authentication (4776) for accounts that normally use Kerberos, Kerberos tickets used from two machines, and a remote logon followed by a new service (4697) or scheduled task (4698). Add network monitoring for workstation-to-workstation SMB, RDP and WinRM, and identity alerts for pass the hash and pass the ticket.
How do you prevent lateral movement?
Remove the credentials and routes it depends on. Give every machine a unique local administrator password with Windows LAPS and deny network logon to local accounts. Keep privileged accounts off lower-tier systems through administrative tiering. Block remote administration protocols between workstations and segment the network with deny-by-default rules. Enable Credential Guard, put privileged users in Protected Users after testing, fix delegation and certificate templates, and keep cloud administrator accounts separate from on-premises Active Directory.
What is the difference between pass the hash and pass the ticket?
Both reuse credential material taken from a machine's memory instead of a password. Pass the hash presents a stolen NTLM password hash to authenticate as the user. Pass the ticket replays a stolen Kerberos ticket from a different machine. Overpass the hash uses a stolen hash to request a new Kerberos ticket. Credential Guard, the Protected Users group and administrative tiering reduce all three.
Does a penetration test measure lateral movement?
Yes. An internal network penetration test starts from an agreed position, such as a standard user account on a standard workstation, and shows how far the tester got, hop by hop, with the credential and technique behind each step, plus segmentation test results and credential hygiene findings. A red team engagement adds what a penetration test does not: whether the movement was detected and how long containment took.
Related reading
Kerberoasting Explained: How the Attack Works, Detection and Fixes (2026)
Password Spraying: How the Attack Works, Detection and Defense (2026)
ARTEX and Agentic Offensive Frameworks: What Google Observed and What to Test (2026)
Internal Penetration Testing (2026): Scope, Delivery, Cost Drivers and Requirements
Will Your SOC Catch a Red Team? Detection and Response Benchmarks for 2026
Red Teaming: What It Is, How an Engagement Runs and When You Need One (2026)
External Penetration Testing (2026): What an External Pen Test Covers, Scope and Cost
Network Penetration Testing: What It Is, Types, Process and Cost (2026)
Talk to Stingrai
Want to know how far one compromised workstation gets in your network, and how many minutes your team needs to stop it? Stingrai scopes internal network penetration tests, Active Directory security assessments and red team engagements with a retest, as a one-time annual engagement or a continuous program. Get a quote.
