Lateral movement is how an attacker moves through a network after the initial compromise. They start on one machine, often a user's laptop. From there, they look for credentials, network shares, and remote access tools. Each step gets them closer to valuable data. The goal is to reach domain controllers, databases, and backup systems without triggering alarms.

Common techniques include pass-the-hash, where the attacker uses a password hash instead of the password to authenticate. Remote desktop protocol lets them log into other machines with stolen credentials. Server message block shares expose files and sometimes allow code execution. Attackers use built-in tools like PowerShell and WMI because they blend in with normal administration. Detecting lateral movement requires visibility into authentication events, network connections, and process execution. A sudden spike in failed logins, unusual RDP connections, or service accounts logging in from workstations are all red flags. Segmentation limits how far an attacker can go. If the compromised laptop cannot reach the database server directly, the attacker has to find another path. Every segment boundary is a speed bump. Enough of them make the attack too slow and noisy to succeed.

Lateral movement techniques

• Pass-the-hash — reuse password hashes to authenticate
• Remote desktop — log into other machines with stolen credentials
• PsExec and WMI — remote execution using built-in tools
• Credential dumping — extract credentials from memory

Lateral movement is where breaches get serious. The initial foothold is bad. The spread is worse.