Lateral Movement: How Attackers Spread Across a Network

An attacker almost never lands where they want to be. The first foothold is usually a workstation belonging to whoever opened the wrong attachment, which is nowhere near the domain controller, the database, or the file server that holds anything worth stealing. Lateral movement is the phase that bridges that gap. It is the attacker turning one compromised machine into two, then five, then a path to the accounts and data that were the point all along.

What lateral movement is

Lateral movement is the set of techniques an attacker uses to move from one system to another inside a network after gaining initial access. On MITRE ATT&CK it is an entire tactic, Lateral Movement (TA0008), because it represents a distinct phase of an intrusion with its own goals and methods.

The defining feature is that it happens inside the perimeter, using access the attacker has already gained. That changes the character of the activity. External attacks look like attacks. Lateral movement looks like administration, because the attacker is using the same protocols, tools, and accounts that real administrators use every day.

The two things attackers need

Lateral movement almost always comes down to two ingredients: a credential and a path.

A credential lets the attacker authenticate to the next machine. It might be a password, an NTLM hash used in a pass-the-hash attack, a Kerberos ticket, or a token harvested from the compromised host. A path means the next machine is actually reachable over a protocol the attacker can use. A flat network where every workstation can reach every server over SMB and RDP is a lateral mover's ideal environment.

Take away either ingredient and movement stalls. That is the core of the defensive strategy: make credentials hard to reuse, and make machines hard to reach.

The common techniques

Attackers overwhelmingly favor legitimate remote administration mechanisms, because that traffic is expected. Many of these fall under Remote Services (T1021).

Technique	Protocol or mechanism	Why attackers use it	ATT&CK
Remote desktop	RDP	Interactive control that looks like normal admin access	T1021.001
SMB and admin shares	SMB	Copy tools and execute across trusted shares	T1021.002
Windows Management Instrumentation	WMI	Remote execution with minimal footprint	T1047
Remote PowerShell	WinRM	Scriptable remote administration	T1021.006
Remote service creation	Service control	Execute code as a service on the remote host	T1569.002
Scheduled task on a remote host	Task scheduler	Execute and persist on the next machine	T1053.005

None of these protocols is malicious. Your administrators use every one of them. That overlap is exactly why lateral movement is hard to spot and why detection has to focus on context rather than the protocol itself.

Shared local admin passwords turn one breach into many

The most reliable accelerant for lateral movement is a local administrator password reused across many machines. Compromise one host, recover that local admin hash, and the same hash unlocks every other machine that shares it, no cracking required. This is why per-machine local administrator password randomization is one of the highest-return controls a defender can deploy. It breaks the single most common one-to-many movement pattern outright.

Living off the land during movement

Attackers doing lateral movement rarely bring loud tooling. They use the remote administration features already present, which is a form of living off the land. WMI, WinRM, and service control are all built in and all expected. This keeps the activity below the threshold of signature-based detection and forces defenders to reason about behavior: who is connecting to what, from where, and whether that pattern has ever been seen before.

How to detect and defend

Containing lateral movement is a two-front effort. Structural controls shrink what an attacker can reach and reuse; detection catches the movement that still happens.

Structural controls

Segment the network. Divide the environment into zones and permit only the traffic that has a business reason to cross between them. Workstations rarely need to reach each other over SMB or RDP; blocking that peer-to-peer path alone removes a huge amount of movement surface. Our network segmentation guide covers the design in depth.
Randomize local administrator passwords. Give every machine a unique, rotated local administrator password so a single stolen hash unlocks exactly one host.
Tier administrative accounts. Keep the credentials that manage servers and domain controllers off ordinary workstations, so compromising a workstation does not hand over high-value credentials cached in memory.
Restrict remote administration paths. Limit which management hosts may initiate RDP, WinRM, and WMI to sensitive systems, and block those protocols from arbitrary sources.
Reduce cached credentials. Limit where privileged accounts log on interactively so their credentials are not left behind on lower-trust machines for an attacker to harvest.

Detection signals

Unusual host-to-host connections. A workstation initiating RDP or SMB to many other workstations, or to a server it has never contacted, is a strong signal. This depends on having a baseline of normal administrative access.
Remote execution artifacts. Service creation, scheduled task creation, and WMI process launches on remote hosts, especially from non-management source systems, are classic movement tells.
Authentication anomalies. The same account authenticating to many machines in a short window, logons at unusual hours, or a workstation account authenticating where it never has before.
Credential access on endpoints. Signs of hash or ticket harvesting on a host often precede the next movement step, so detecting the theft buys time before the spread.
New remote logons to high-value systems. Any interactive or network logon to a domain controller, database, or backup server from an unexpected source warrants immediate review.

Baseline normal administration first

Every lateral movement detection depends on knowing what normal looks like. Before writing rules, map which management hosts legitimately reach which systems and over which protocols. Once that baseline exists, lateral movement shows up as the connections that fall outside it: the workstation reaching a server it never touches, the account logging into ten machines in a minute. Without the baseline, the attacker's traffic is indistinguishable from your own administrators.

Mapping movement to the wider intrusion

Lateral movement sits in the middle of an intrusion, between initial access and the final objective. Understanding where it fits helps prioritize defenses across the whole chain. Our MITRE ATT&CK tactics reference lays out how the phases connect, and our Threat Group Directory shows which movement techniques specific adversaries favor, which is useful for tuning detections to the threats you actually face.

The bottom line

Lateral movement is the phase where a contained incident becomes a company-wide one. It runs on stolen credentials and legitimate remote administration, so it hides inside normal operations. The defense is structural before it is detective: segment the network so hosts cannot freely reach each other, randomize local admin passwords so one stolen credential unlocks one machine, and keep privileged credentials off low-trust hosts. Then baseline normal administration so the movement that still occurs stands out against it. Slow the attacker's spread and you turn a breach into an incident instead of a disaster.

A worked example, foothold to objective

Following one intrusion through its middle phase shows how the ingredients combine. An attacker gains initial access on a marketing workstation through a malicious document. That machine holds nothing of value, so the whole point of the next phase is to travel from it to something that matters, such as a file server or a domain controller.

The first move is orientation. The attacker enumerates the local machine and the surrounding network: which accounts are cached, which shares are reachable, which other hosts respond. This reconnaissance is quiet because it uses ordinary queries that administrators also run. The attacker is building a map of credentials and paths, the two ingredients movement depends on.

Next comes credential harvesting on the foothold. If a privileged account logged on to this workstation recently, its credential material may be recoverable from memory. If the local administrator password is shared across the fleet, recovering that single hash is enough to authenticate to many other machines without ever cracking it. Either outcome hands the attacker a credential that reaches beyond the current host.

With a credential in hand, the attacker picks a path. Suppose the recovered local admin hash works on a nearby server. The attacker authenticates to it over SMB, copies a tool to an administrative share, and executes it, or uses WMI to launch a process remotely with no file written to disk at all. That server becomes the second foothold, and the attacker repeats the cycle: enumerate, harvest, move. Each hop is chosen to inch closer to the objective while using protocols that look like administration.

The sequence ends when the attacker reaches a host that stores or controls the target. Perhaps a cached domain administrator credential on the second server lets them authenticate to a domain controller, at which point they can create accounts, reset passwords, and reach essentially anything. The intrusion that began on a marketing laptop is now a domain-wide compromise, and every hop in between used a legitimate protocol and a real credential.

The defensive reading of this walkthrough is that every hop needed both a credential and a path, and removing either at any point would have stalled the chain. Unique local admin passwords would have stopped the first hop. Segmentation that blocked the workstation from reaching the server would have stopped it too. Keeping the domain admin credential off that second server would have prevented the final jump.

Detection signals in depth

The structural controls above shrink the attack surface, but some movement will still occur, and detection is what catches it. The signals below become reliable once a baseline of normal administration exists.

Workstation-to-workstation administration traffic. Ordinary users rarely need RDP, SMB, or WMI between their machines. A workstation initiating those protocols to peers, or to a server it has never contacted, is one of the strongest single indicators.
A single account authenticating broadly in a short window. One account logging on to many hosts within minutes suggests automated movement rather than a human administrator working one system at a time.
Remote execution artifacts. Creation of a new service, a scheduled task, or a remotely launched process on a host, especially originating from a non-management source, is a classic movement tell recorded in system logs.
Credential access behavior on endpoints. Signs of memory access against the process that holds credential material, or unusual reads of credential stores, often precede the next hop and give defenders a chance to act before the spread.
Logons to high-value systems from unexpected sources. Any interactive or network logon to a domain controller, database, or backup server from a host that has no business reaching it deserves immediate review.
Use of administrative shares. Access to hidden administrative shares to stage tools is a common precursor to remote execution, and connections to those shares from unusual sources are worth alerting on.
Anomalous authentication protocols. Requests for tickets covering many services in a short period, or authentication that skips the expected sequence, can indicate ticket abuse feeding movement.

Log the source alongside the event

A service creation or a remote logon on its own is routine. What makes it a movement signal is the source: which host initiated it, under which account, and whether that pairing has ever been seen before. Detection rules that capture the source host and account alongside the event turn a noisy stream of ordinary administration into a short list of connections that do not fit the baseline. Without the source, you cannot tell the attacker's hop from your own team's maintenance.

Lateral movement techniques compared

Attackers choose among several remote execution methods, and each leaves a different footprint. Understanding the trade-offs helps defenders decide where to focus logging.

Method	How execution happens	Footprint for defenders	Attacker trade-off
RDP	Interactive desktop session	Logon events, session artifacts	High visibility, but looks like normal admin
SMB with admin shares	Copy a tool, then execute	Share access and new files	Simple and reliable, writes to disk
WMI	Remote process invocation	Process creation, WMI logs	Minimal on-disk footprint
WinRM	Scriptable remote shell	Remote session logs	Blends with legitimate remote management
Remote service creation	Run code as a service	New service in the registry and logs	Durable, but service creation is noisy
Scheduled task	Task runs on the remote host	New task entries	Adds persistence, leaves task artifacts

No method is inherently more malicious than another, which is the recurring theme. Each is a legitimate administrative capability, so the detection value comes from watching the context around its use rather than the use itself.

Common mistakes and misconceptions

Several beliefs weaken a defense against lateral movement.

"A strong perimeter is enough." The perimeter addresses initial access. Once an attacker is inside, a flat internal network lets them reach everything, and the perimeter offers no help. Internal reachability is a separate problem that segmentation, not the firewall at the edge, has to solve.

"We patched, so we are safe from movement." Most lateral movement uses legitimate protocols and stolen credentials, not an unpatched exploit. Patching matters for initial access and privilege escalation, but a fully patched environment with shared local admin passwords and a flat network is still wide open to movement.

"Detecting malware will catch it." Attackers moving laterally often bring no malware, using built-in tools in a living-off-the-land style. Signature-based detection has little to catch, which is why behavior-based detection anchored to a baseline is necessary.

"Segmentation is only about VLANs." Network zones are part of it, but segmentation that matters for movement includes host firewalls blocking peer-to-peer administration, identity tiering that keeps privileged credentials off low-trust hosts, and application-level controls. The goal is to shrink what any one compromised host can reach and reuse, by whatever combination of controls achieves it.

"One stolen credential is a small problem." With a shared local admin password or an over-privileged service account, one credential can unlock the entire fleet. The blast radius of a single credential is exactly what per-machine randomization and credential tiering are designed to contain.

How the discipline evolved

Early network defense concentrated almost entirely on the perimeter, on the assumption that keeping attackers out was the whole job. As intrusions became better understood, defenders recognized that initial access was close to inevitable and that the damage came from what happened after, during the movement toward valuable systems. That shift in thinking produced the frameworks that now describe intrusions as a sequence of phases, with lateral movement as a distinct stage between the foothold and the objective.

The defensive response matured alongside. Per-machine local administrator password randomization emerged to break the one-to-many pattern of shared credentials. Credential tiering arose to keep high-value accounts off low-trust machines. The zero trust model, which treats internal reachability as something to be earned rather than assumed, is the current expression of the same lesson: assume a foothold will happen and design the interior so that a single compromised host cannot freely reach the rest. The through-line across all of it is a move from guarding the edge to constraining the interior.

Identity has become the real network

For a long time the mental model of movement was geographic: hosts on a wire, reachable or not. That model still matters, but identity now carries at least as much weight. Cloud services, single sign-on, and federated access mean an attacker who holds the right token or session can reach systems that share no physical network at all. Movement in these environments looks less like hopping across machines and more like assuming identities and inheriting their access.

The practical consequence is that credential hygiene and identity controls sit alongside network segmentation as first-class defenses. Short-lived tokens, strong authentication on privileged accounts, and tight scoping of what any single identity can reach limit how far a stolen session travels. The same principle that governs the network applies to identity: assume one credential will be compromised, and design so that it unlocks as little as possible. An attacker who steals a session for a low-privilege identity should not be one step from everything, which is the identity equivalent of a flat network and just as dangerous.

Frequently asked questions

How is lateral movement different from privilege escalation? They solve different problems and often interleave. Privilege escalation raises the attacker's rights on a host they already control, moving from a standard user to administrator. Lateral movement carries the attacker from one host to another. A typical intrusion alternates between the two: escalate on this machine, move to the next, escalate there, and so on toward the objective.

Why do attackers prefer built-in tools over custom malware for movement? Built-in remote administration tools generate traffic that defenders expect, because real administrators use the same tools every day. That overlap keeps the activity below signature-based detection and forces defenders to reason about behavior instead. Bringing custom malware adds a footprint that endpoint tools are more likely to catch.

What is the single highest-value control against lateral movement? Network segmentation is usually the highest-value structural control, because it directly shrinks what any compromised host can reach. Close behind it is per-machine local administrator password randomization, which breaks the most common one-to-many movement pattern. Together they remove both the paths and the reusable credentials movement depends on.

Can zero trust stop lateral movement entirely? Zero trust makes movement much harder by requiring each access to be authenticated and authorized rather than assumed from network position, which removes the flat-network advantage attackers rely on. It reduces the surface substantially, but no single model stops a determined attacker outright, so it works best combined with credential hygiene and behavior-based detection.

How do stolen hashes enable movement without a password? Some authentication protocols accept a password's hash as proof of identity, so an attacker who recovers the hash can authenticate without ever knowing or cracking the underlying password. This is why a single shared local administrator hash can unlock many machines, and why breaking credential reuse matters more than password strength alone for this phase.

Does encryption of internal traffic stop lateral movement? No. Encryption protects the confidentiality of data in transit, but the attacker is using legitimate, authenticated connections, so encrypted channels carry their traffic just as they carry an administrator's. The controls that matter are limiting reachability, limiting credential reuse, and detecting anomalous access, none of which encryption provides.

How long does lateral movement usually take? It varies widely. Automated movement across a flat network with shared credentials can happen in minutes, while a careful, stealthy actor may move slowly over days or weeks to avoid detection. The speed depends on the attacker's goals and the friction the environment imposes, which is precisely what segmentation and credential hygiene are meant to increase.

Where should a defender start if resources are limited? Begin with the two controls that remove the most surface for the least effort: unique local administrator passwords per machine, and segmentation that blocks workstation-to-workstation administration. Those two changes break the most common one-to-many patterns. After that, keep privileged credentials off low-trust hosts and build a baseline of normal administration so anomalous access can be detected.