TermAttack

Lateral movement

The attacker moving from the system they first entered to other systems on the same network.

Flow

1Credentials obtained
2Targets found
3Moves across

Related families: —
MITRE ATT&CK: TA0008 · Lateral Movement
Sources: 7 sources

Overview

MITRE ATT&CK defines lateral movement as the methods an attacker uses to enter and control remote systems on a network. It is usually done with legitimate remote access tools and stolen credentials. MITRE ATT&CK

Even if the credential of an administrator account is stolen from a single device, it may be enough to move to many systems. Google Cloud (Mandiant)

How it works

1
Credentials obtained
From the first device or from logs. MITRE ATT&CK
2
Targets found
Servers and shares on the network are scanned. MITRE ATT&CK
3
Moves across
With remote desktop, SMB or remote management tools. MITRE ATT&CK

Real-world examples

One contractor, several organizations

Mandiant emphasized that a single contractor laptop infected by an infostealer, often with IT and administrator privileges, could enable access to multiple organizations. Google Cloud (Mandiant)

How to detect it

An account opening remote sessions on an unusual number of systems within a short time. MITRE ATT&CK

What to do

Separate and restrict administrator accounts. MITRE ATT&CK
Segment internal network traffic. MITRE ATT&CK

MITRE ATT&CK

TA0008Lateral Movement T1021Remote Services T1078Valid Accounts T1046Network Service Discovery

Related terms

Terms

Privilege escalation Remote Access Trojan Zero trust

Sources

1Lateral Movement (TA0008) · MITRE ATT&CK
2Remote Services (T1021) · MITRE ATT&CK
3Valid Accounts (T1078) · MITRE ATT&CK
4Network Service Discovery (T1046) · MITRE ATT&CK
5UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
6Privileged Account Management (M1026) · MITRE ATT&CK
7Filter Network Traffic (M1037) · MITRE ATT&CK