Security Fundamentals · Study Notes

Networks & Lateral Movement

ONE FOOTHOLD · MANY PATHS

A breach is rarely a single step. An attacker lands on one low-value machine and then moves sideways — host to host, credential to credential — until they reach what they actually came for: domain controllers, data, and admin accounts. This page maps that journey onto the MITRE ATT&CK framework: the real techniques, the tools that execute them, how each is detected, and the controls that break the chain.

01 The attack lifecycle

Lateral movement is one tactic in a longer chain

Frameworks exist so defenders and attackers describe the same thing the same way. The Cyber Kill Chain (Lockheed Martin) gives the high-level arc; MITRE ATT&CK breaks it into concrete, observed techniques, each with an ID like T1021. Lateral movement is tactic TA0008 — but it only matters because of what comes before and after it.

Phase	ATT&CK tactic	What happens
Recon	TA0043 Reconnaissance	Map the target — domains, hosts, people, exposed services
Initial access	TA0001 Initial Access	Get the first foothold (phish, exploit, valid creds)
Execution & persistence	TA0002 / TA0003	Run code; survive reboots and logouts
Credential access	TA0006 Credential Access	Steal hashes, tickets, tokens from the foothold
Lateral movement	TA0008	Use those credentials to reach the next host
Privilege escalation	TA0004	Climb from user → local admin → domain admin
Collection & exfiltration	TA0009 / TA0010	Gather and remove the target data

The core idea

Lateral movement is credential reuse plus legitimate protocols. Attackers rarely drop new exploits to move internally — they log in. The traffic looks like normal admin activity, which is exactly why it's hard to spot and why segmentation and least privilege matter more than any single detection.

02 Network zones & why they exist

Segmentation is the single biggest limiter of blast radius

A flat network — where every host can talk to every other — means one foothold reaches everything. Zoning divides the network into trust tiers with controlled crossing points, so a compromise in one zone doesn't automatically become a compromise of all of them.

DMZ (Demilitarised Zone)

Internet-facing services (web, mail, VPN) live here, isolated from the internal network. If a public server is popped, the attacker is still boxed out of the core.

Internal / user network

Workstations and everyday systems. The most common landing zone for phishing, and the launch pad for moving deeper.

Server zone

Application, database and file servers. Should only accept the specific traffic it needs — not general access from every workstation.

High-value / tier-0

Domain controllers, credential stores, backups, admin infrastructure. Compromise here = game over. Treated as its own hard boundary.

Ports you'll see on the path

445 SMB3389 RDP5985/5986 WinRM135 RPC/DCOM88 Kerberos389/636 LDAP22 SSH5900 VNC

03 Getting the first foothold

TA0001 — how attackers get in before they can move

Lateral movement needs a starting point. The overwhelming majority of real intrusions begin with one of three things, none of which is a Hollywood "hack":

Phishing (T1566) — a user runs an attachment or enters credentials on a fake page. Still the number-one initial vector.
Exploiting a public-facing service (T1190) — an unpatched VPN, web app or mail server with a known CVE.
Valid accounts (T1078) — stolen, reused, or default credentials bought or sprayed. No exploit required.

Why patching exposed services is non-negotiable

Several of the worst breaches in history started at step one here. EternalBlue (CVE-2017-0144, MS17-010) — an SMB flaw — gave WannaCry and NotPetya both their entry and their worm-like spread in 2017. A single unpatched edge service can be the whole story.

04 Lateral movement techniques

TA0008 — the real ATT&CK techniques, how they work, how they're caught

Once an attacker holds credentials from the foothold, these are the techniques they use to reach the next machine. Each row is a mapped ATT&CK technique — learn the mechanism, not just the name.

Credential-based movement

Technique / ID	How it works	Tools	Detection signal
Pass-the-Hash T1550.002	Authenticate with the NTLM hash directly — the plaintext password is never needed	mimikatz, impacket, NetExec	NTLM logons (Event 4624 type 3) from unusual source hosts
Pass-the-Ticket T1550.003	Inject a stolen/forged Kerberos ticket into a session to impersonate a user	mimikatz, Rubeus	Tickets with anomalous lifetimes; TGT/TGS mismatches
Kerberoasting T1558.003	Request service tickets (TGS) for SPN accounts, crack them offline for the service password	Rubeus, impacket-GetUserSPNs, hashcat -m 13100	Bursts of TGS requests (Event 4769) with RC4 encryption
AS-REP Roasting T1558.004	Target accounts with Kerberos pre-auth disabled; crack the returned AS-REP offline	Rubeus, impacket-GetNPUsers, hashcat -m 18200	AS-REQ for accounts that shouldn't be queried
Credential reuse T1078	A shared local-admin password or reused user password opens the next box outright	NetExec, spray scripts	Same account authenticating across many hosts quickly

Remote-service movement (T1021)

These abuse legitimate remote-administration protocols — the same ones sysadmins use daily — which is what makes them blend in.

Sub-technique / ID	Protocol / port	Typical use
Remote Desktop Protocol — T1021.001	RDP · 3389	Interactive graphical session to another host
SMB / Windows Admin Shares — T1021.002	SMB · 445	PsExec-style remote execution via ADMIN$ / C$
Distributed COM — T1021.003	DCOM · 135	Execute via COM objects (e.g. MMC20)
SSH — T1021.004	SSH · 22	The Linux/Unix equivalent of RDP movement
Windows Remote Management — T1021.006	WinRM · 5985/5986	PowerShell Remoting; evil-winrm with creds/hash

impacket — remote execution with a captured hash
# pass-the-hash to a SYSTEM shell over SMB (T1021.002 + T1550.002)
impacket-psexec -hashes :<NThash> DOMAIN/admin@10.0.0.25

# dump every secret from a domain controller (needs DA / DCSync rights)
impacket-secretsdump DOMAIN/admin@dc01 -just-dc

# spray one hash across a whole subnet to find where it is admin
nxc smb 10.0.0.0/24 -u admin -H <NThash> --local-auth

Blue-team reframe

Every technique above produces a logon event. The detection isn't a magic signature — it's behavioural: a service account logging on interactively, one account touching 40 hosts in a minute, NTLM where Kerberos is expected, RC4 tickets in an AES environment. This is what "unusual east-west traffic" on a SIEM dashboard actually means.

05 The Active Directory attack path

Why AD is the centre of gravity in a Windows breach

In most enterprises, Active Directory is the single source of truth for who can access what. Compromising it compromises everything downstream — so attackers treat reaching Domain Admin (or the krbtgt account) as the objective. A typical path:

Enumerate — map users, groups, sessions and ACLs. BloodHound graphs the shortest path from "any user" to "Domain Admin".
Harvest credentials — dump LSASS (T1003.001) on the foothold for cached hashes and tickets.
Roast — Kerberoast service accounts (T1558.003) for crackable high-privilege passwords.
Move & repeat — pass-the-hash / pass-the-ticket to the next host, dump again, climb.
DCSync (T1003.006) — once privileged, replicate the directory and pull every hash, including krbtgt.

Golden & Silver tickets

With the krbtgt hash an attacker forges a Golden Ticket (T1558.001) — a self-signed TGT granting access as anyone, to anything, that survives password resets. A Silver Ticket (T1558.002) forges a service ticket for one specific service. This is why recovering from a true DA compromise often means rotating krbtgt twice — and sometimes rebuilding the forest.

06 Privilege escalation along the way

TA0004 — climbing from user to administrator

Movement and escalation interleave. Each new host may offer a local privilege-escalation route that yields fresh, higher-value credentials to move again:

Unquoted service paths & weak service permissions — a low-priv user can replace a binary a SYSTEM service runs.
Misconfigured sudo / SUID binaries (Linux) — GTFOBins catalogues which allow a shell escape to root.
Token impersonation (T1134) — "potato" attacks abuse SeImpersonate to jump to SYSTEM.
Over-permissioned AD ACLs — a user with write access to a group or GPO can grant themselves more.

Enumerate first

Tools like WinPEAS / LinPEAS automate the "what can I abuse here" check on a new host — the same checks a defender should run to find and close the gaps first.

07 Containment & defence

Break the path, limit the blast radius

You can't prevent every foothold — so the goal is to make sure one foothold stays one foothold. These controls directly map to the techniques above.

Control	What it stops
Network segmentation & VLANs	Removes the flat-network assumption; a DMZ foothold can't reach the server zone
Least privilege + LAPS	Unique local-admin passwords per host kill credential-reuse spraying
Tiered administration	Tier-0 (DC) admins never log on to workstations, so their creds never land where they can be stolen
MFA everywhere	A stolen password alone no longer grants access — especially on VPN, RDP and privileged logins
Disable/limit NTLM; enforce Kerberos + AES	Removes pass-the-hash surface and RC4 roasting weakness
EDR + SIEM on east-west traffic	Detects the behavioural anomalies these techniques generate
Patch exposed & internal services	Closes the worm routes (EternalBlue, BlueKeep `CVE-2019-0708`, PrintNightmare, Zerologon `CVE-2020-1472`)
Credential Guard & LSASS protection	Stops the memory-dump step that feeds everything downstream

The defender's mantra

SEGMENT · LEAST PRIVILEGE · MFA · DETECT · PATCH

08 References & further reading

Authoritative sources — go deeper here

MITRE ATT&CK — Lateral Movement (TA0008) — attack.mitre.org
T1021 Remote Services & T1558 Steal or Forge Kerberos Tickets — MITRE
BloodHound documentation — AD attack-path analysis — SpecterOps
HackTricks — Active Directory methodology — book.hacktricks.wiki
Microsoft — Securing privileged access & the tiered model — learn.microsoft.com
NCSC — Mitigating malware and ransomware attacks — ncsc.gov.uk
CISA — detecting and evicting lateral movement — cisa.gov