Lateral movement

The first machine an attacker lands on is almost never interesting. It belongs to somebody in finance or logistics, and what the attacker wants is somewhere else: a file server, a database, a domain controller, a backup system, a payment platform. Lateral movement is the work of getting from one to the other.

It runs as a loop. Look around from where you are: what does this machine reach, what credentials are cached on it, what shares are mapped, what agents are installed, what does the directory say about the accounts that use it. Take whatever credential material is available. Use it to authenticate somewhere new. Repeat from there. The loop ends when the attacker reaches something that satisfies the objective, or when it becomes cheaper to escalate privileges instead.

The mechanisms are almost entirely built-in functionality. Remote service creation, remote management protocols, remote desktop, scheduled task creation on a remote host, management agents that can push a command to every machine they cover, and in Linux estates a reused private key. All of these are administration. None of them is malicious in isolation, which is precisely why they are chosen over an exploit: an exploit can fail and can crash the target, whereas a valid credential over a standard protocol works every time and looks like work.

Movement and escalation are separate axes and they interleave. Moving sideways with the same rights opens new territory; escalating on one machine opens better credentials for the next move. Real intrusions alternate between them, which is why an incident timeline reads as a zigzag rather than as a straight climb.

The condition that makes movement easy is a flat network. Everything can reach everything on every administrative port, because segmentation was never finished, or because it exists between the office and the datacentre and not inside the datacentre. On engagements we frequently find that the second machine is reachable from the first, and the two hundredth is reachable from the second.

The second condition is credential reuse, and the standard case is one local administrator password across an image. That single fact converts one compromise into all of them without any escalation being needed, which is why pass-the-hash is so often the first and last technique in an internal report.

The third is where privileged accounts leave material. An administrator opening a session on an ordinary workstation, a service running under a domain account, a management agent authenticating with a shared credential. The attacker does not need to reach the target: they need to be on a machine the target’s credentials will visit.

The fourth is detection. Each individual step produces a successful authentication and a legitimate administrative action, and both are the most common events in the estate. There is no failure to alert on. What makes the sequence visible is not any one event but the shape: a workstation initiating administrative connections, an account authenticating to hosts it has never touched, a burst of connections in a pattern no human working day produces.

These two are described together and they are separate mechanics with separate defences.

The reason to keep them apart is ownership. Reducing movement is largely a network and identity problem; reducing privilege escalation is largely a platform and configuration problem. An organisation that treats them as one item assigns the work to one team, and half of it does not get done.

Believing the perimeter is the control. Once one machine inside is compromised, the perimeter has no further effect on anything described here.

Segmenting by site and not by function. A flat datacentre behind a segmented office network is still flat where it matters.

Allowing administrative protocols between workstations. One workstation almost never needs remote administrative access to another. Blocking that single class of traffic removes a large share of the easy paths.

Treating an EDR alert as containment. Detection without response is a record of the intrusion. Where nobody is on shift, the attacker has hours.

Assuming cloud estates do not have this problem. They have the same problem with different primitives: a compromised workload with a role that can assume another role, and a cloud attack path that ends at the same kind of data.

Segment for the intrusion you will have rather than for the topology you drew. Network segmentation that separates workstations from servers, and servers from each other by function, converts one compromise into one segment. Blocking workstation to workstation administrative traffic is usually the highest-value single rule available, and it breaks almost nothing.

Remove the credential reuse. Per-host local administrator passwords, service accounts with directory managed passwords, and administrative accounts that cannot log on to ordinary machines. Combined, these three make each step cost the attacker something rather than being free.

Then instrument for the shape rather than for the event. The detections that work are relational: an account authenticating to a host it has no history with, one source authenticating to many destinations in a short window, administrative protocol use from a subnet where administration does not happen, and remote service or scheduled task creation anywhere outside a change window. Feed the same signals into your SIEM with the host and account baselines that make them meaningful, because without the baseline they are all normal.

Finally, test it. The question is not whether the tooling can detect a technique in a laboratory, but whether a real path exists from an ordinary workstation to your most valuable system, and how many steps it takes. That is measurable, and the number is the metric worth tracking year on year.

Internal engagement reports are written as paths, and lateral movement is the connective tissue between the findings. Each step records the source host, the destination, the credential used, the protocol, and the time. That structure lets a client see that closing one step, usually credential reuse or one segmentation rule, collapses several findings at once.

We are explicit about which steps used valid credentials and which used a vulnerability, because the remediation owner differs and because the first category will not appear in any scanner output.

Severity attaches to the path’s destination and to its length. A path of eight steps requiring several lucky conditions is a different risk from a path of two steps that works from any workstation. We state the number of steps and the preconditions, so the client can decide where to cut.

Establishing whether such a path exists at all is the core question of a test conducted from inside the network, and it is usually answered in the first day.

How do attackers move laterally without malware? By using the administration tools that are already there: remote management protocols, remote desktop, remote service and scheduled task creation, and management agents. With a valid credential, none of this requires anything to be installed.

Does network segmentation stop lateral movement? It does not stop it, it constrains it. Good segmentation means a compromise reaches one zone instead of the estate, and it forces the attacker to make noisier attempts at the boundary, which is where you have a chance of seeing them.

How long does lateral movement take in a real intrusion? It varies from hours to months, and in most estates we test the technical distance is short. Where an intrusion takes weeks it is usually because the attacker chose to be slow, not because the network made it hard.

What is the single most effective change? Removing shared local administrator credentials, then blocking administrative protocols between workstations. Those two remove the free steps, and everything after that costs the attacker time you can detect.