Lateral Movement Guide: Techniques and Detection

Most serious intrusions are decided after the first foothold, when an attacker uses stolen credentials and built-in remote administration to move from one workstation to the servers and identity systems that matter. Lateral movement rarely needs malware: it rides on SMB, RDP, WMI, WinRM, SSH and deployment tools that administrators use every day, which is why it blends into normal traffic. This guide maps the main techniques to MITRE ATT&CK v20, then concentrates on what defenders control: credential hygiene, relay protections, hardened remote administration, segmentation and the logon telemetry that exposes movement. It is written for detection engineers, Windows and identity administrators, and security architects, with Windows examples because most enterprise lateral movement still runs through Active Directory.

Key takeaways

• Lateral movement is an identity problem first. Almost every technique needs a valid account, a hash or a ticket, so shared local administrator passwords and privileged sessions on workstations are the real enablers.
• Close the relay and reuse paths. Required SMB signing, Windows LAPS, disabled LLMNR and NetBIOS name resolution, and denied network logon for local administrators remove the cheapest routes.
• Restrict who can reach management ports. SMB 445, RPC 135, WinRM 5985/5986, RDP 3389 and SSH 22 between workstations should be blocked; administration should come only from defined management hosts.
• Detect the pattern, not the tool. A network logon followed by a new service, scheduled task or process spawned by WmiPrvSE.exe or wsmprovhost.exe on the target is more durable than any tool signature.
• Deployment and cloud consoles are lateral movement at fleet scale. Software deployment tools (T1072) and cloud management planes let one stolen admin identity reach every device at once.

How lateral movement works

ATT&CK defines the Lateral Movement tactic (TA0008) as techniques adversaries use "to enter and control remote systems on a network". In practice every move combines three elements, and each is a place to break the chain:

• Credential material: a password, NTLM hash, Kerberos ticket, SSH key or access token taken from the first host, often from a privileged user who logged on to it. Pass the Hash (T1550.002) and Pass the Ticket (T1550.003) reuse that material without knowing the password.
• A remote channel: SMB and admin shares, RPC for WMI and DCOM, WinRM, RDP, SSH, or a management platform.
• Remote execution: creating a service, a scheduled task, a WMI process or an interactive session on the target, frequently after copying a tool across (Lateral Tool Transfer, T1570).

Discovery feeds this loop. Attack path tools such as BloodHound and its SharpHound collector map which accounts are local administrators where and which sessions are live, so the same data is worth collecting defensively to find and cut the shortest paths to domain admin. Note that in ATT&CK v20 the relay technique, Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay (T1557.001), sits under Credential Access and Collection, not Lateral Movement, although it is usually the step that makes the next move possible.

Techniques and what defenders see

The table lists the v20 Lateral Movement techniques defenders meet most often, the channel they use and the evidence they leave on the destination host.

Tool frameworks such as Impacket, NetExec (the community successor to CrackMapExec) and Cobalt Strike wrap these same channels. Detection that keys on the channel plus the execution outcome survives tool changes; detection that keys on a tool name does not.

Credential reuse and relay: removing the cheap routes

CISA and NSA's top ten misconfigurations advisory lists poor credential hygiene and lack of segmentation, and notes that "If SMB servers do not enforce SMB signing, malicious actors can use machine-in-the-middle techniques, such as NTLM relay." These controls carry the most weight:

• Unique local administrator passwords: Windows LAPS rotates and backs up each device's local administrator password to Entra ID or Active Directory, and Microsoft lists "Protection against pass-the-hash and lateral-traversal attacks" as a benefit. Use encryption and password history when backing up to AD.
• Deny network use of local administrators: assign "Deny access to this computer from the network" and "Deny log on through Remote Desktop Services" to the "Local account and member of Administrators group" principal, and keep the policy "Apply UAC restrictions to local accounts on network logons" enabled (LocalAccountTokenFilterPolicy not set to 1). ATT&CK's own mitigation is to "Deny remote use of local admin credentials to log into systems."
• Require SMB signing: from Windows 11 24H2 and Windows Server 2025, inbound and outbound SMB signing is required by default. On older systems set "Microsoft network client: Digitally sign communications (always)" and "Microsoft network server: Digitally sign communications (always)". Use the 24H2 audit policies "Audit server does not support signing" and "Audit client does not support signing" to find non-Microsoft devices that will break first.
• Remove poisoning opportunities: disable LLMNR with "Turn off multicast name resolution" (Administrative Templates > Network > DNS Client), disable NetBIOS over TCP/IP and review mDNS. Responder-style poisoning listens on UDP 5355 and UDP 137 to collect hashes for relay or cracking.
• Protect relay targets: coercion techniques such as PetitPotam (MS-EFSRPC) and PrinterBug (MS-RPRN) force servers, including domain controllers, to authenticate to an attacker. Microsoft's KB5005413 guidance for AD CS web enrolment is to enable Extended Protection for Authentication and require HTTPS; also disable the Print Spooler on servers that do not print.
• Reduce NTLM: connecting to shares by IP address or CNAME falls back to NTLM. The Windows 11 24H2 SMB client can block outbound NTLM with named exceptions; audit NTLM use (event 4776 on domain controllers) before restricting it.

Hardening remote administration channels

• RDP: require Remote Credential Guard through "Restrict delegation of credentials to remote servers" (Administrative Templates > System > Credentials Delegation). Microsoft's comparison shows both Remote Credential Guard and Restricted Admin prevent pass the hash, but Restricted Admin needs Administrators group membership on the target while Remote Credential Guard works with Remote Desktop Users and is Kerberos only. Set disconnected and idle session limits to shrink the RDP hijacking window, and block RDP between security zones.
• WinRM and PowerShell remoting: allow it only from management hosts, prefer HTTPS on 5986, use Just Enough Administration endpoints for routine tasks and keep script block logging on. See the PowerShell Security Guide.
• WMI, DCOM and PsExec: the Microsoft Defender attack surface reduction (ASR) rule "Block process creations originating from PSExec and WMI commands" (d1e49aac-8f56-4280-b9ba-993a6d77406c) stops a common execution path, but Microsoft warns that the Configuration Manager client relies heavily on WMI, so do not enable it on Configuration Manager-managed devices by other methods.
• Admin shares: ATT&CK suggests disabling administrative shares where nothing depends on them; at minimum, block TCP 445 inbound on workstations with the host firewall.
• SSH: disable agent forwarding (AllowAgentForwarding no) on servers that do not need it, use ProxyJump through bastions instead, and replace static keys with short-lived certificates. See the SSH Key Management Guide.
• Deployment tools and management consoles: Intune, Configuration Manager, remote monitoring and management (RMM) tools and hypervisor managers are tier zero. Require phishing-resistant MFA, just-in-time roles and multi-administrator approval for bulk actions. Attackers also use a supplier's trusted management connection to reach its customers, sometimes called island hopping, so third-party RMM access needs the same controls. See the Third-Party Access Guide.

Segmentation and administrative tiering

Credential controls make movement harder; segmentation limits how far one success goes. CISA defines microsegmentation as "a networking control that limits connections to a zone or segment", and lists "Reducing the surface for lateral movement of adversaries that have breached networks" as a core benefit. Microsoft's enterprise access model, which evolved from the AD tier model, adds the identity dimension: separate control, management and workload planes, with a hierarchy enforced so that higher planes cannot be controlled from lower ones. In practice that means domain admins never sign in to workstations, and administration happens from privileged access workstations.

Small organisations get most of the value from host firewall rules, Windows LAPS, required SMB signing, disabled LLMNR and separate admin accounts, all achievable with Group Policy or Intune in weeks. Large organisations should add tiering, privileged access workstations, attack path analysis and microsegmentation for crown-jewel applications, because flat networks with thousands of local admin relationships cannot be reviewed by hand.

Detection and measurement

Forward these sources to the SIEM from servers, domain controllers and a representative set of workstations at minimum.

The strongest analytic is a sequence: a 4624 type 3 logon from host A to host B, then a 7045, 4698 or WmiPrvSE.exe child process on B within a short window, from an account that has not done this before. ATT&CK's detection strategy for admin shares describes exactly this share-access-then-execution chain. See the Windows Event Log Guide for audit policy settings.

Metrics that show the programme is working:

• Local admin uniqueness: percentage of Windows devices with a LAPS-managed password rotated within policy (target 100%).
• Signing and NTLM: share of SMB servers requiring signing, and NTLM authentications per day trending down.
• Exposure: number of workstations reachable on 445, 3389 or 5985 from other workstations, measured by internal scans.
• Attack paths: count of accounts or sessions that give a path to domain admin in attack path analysis, reviewed monthly.
• Tier hygiene: tier zero account logons to non-tier-zero hosts per month (target zero).
• Detection speed: time from first lateral hop to alert in purple team exercises.

Implementation: a phased rollout

1. Baseline: enable the audit policies and Sysmon events above, collect logons for 30 days and map which hosts legitimately administer which. Run attack path analysis to find the worst exposures.
2. Quick wins in audit mode: deploy Windows LAPS, turn on SMB signing audit policies and NTLM auditing, and set the PsExec and WMI ASR rule to audit to see what would break.
3. Pilot ring: apply host firewall blocks, deny network logon for local administrators, disabled LLMNR and NetBIOS, and required SMB signing to IT devices first, then a business pilot of 5-10% of devices.
4. Broad enforcement: roll out by ring with a named rollback for each control: the Group Policy or Intune profile to unlink, and the exception process for legacy NAS devices and printers that cannot sign.
5. Tiering and privileged access: separate admin accounts, privileged access workstations for tier zero, Remote Credential Guard for RDP, and just-in-time roles for management consoles.
6. Segmentation: follow CISA's four phases (identify candidate resources, map dependencies, define policy, deploy) and run new policies in a permissive mode that flags violations before blocking.
7. Validate: run purple team exercises against the techniques table each quarter and track detection speed.

Where identity fits

Lateral movement is credential abuse with a network hop attached. Service accounts are especially exposed: they often hold local administrator rights on many servers, have passwords that never change and log on interactively to run scheduled jobs, leaving credentials in memory. Prefer group managed service accounts, deny their interactive and RDP logon, scope them to the hosts they serve and alert when one authenticates from a new source. See the Service Account Security Guide. Hybrid identity infrastructure is a bridge between planes: in the Storm-0501 hybrid cloud attacks, Microsoft reported that the group extracted Entra Connect Sync credentials after reaching Domain Admin and used them to move into the cloud tenant. Treat sync servers, federation servers and PAM vaults as tier zero. See the Active Directory and Entra ID Hardening Guide and the ITDR Guide.

Common failure patterns

• One local administrator password everywhere: a single hash from a gold image opens every machine built from it. LAPS coverage gaps, often servers and kiosks, keep this alive.
• Domain admins on workstations: helpdesk or project staff use privileged accounts for routine support, leaving reusable credentials on low-trust hosts.
• Management console treated as an IT tool, not tier zero: in the Stryker Intune wiper attack, a source told reporters that the attacker compromised an administrator account, created a new Global Administrator and issued Intune wipe commands without any malware on endpoints.
• Signing enforced on domain controllers only: member servers and file shares stay relayable, and LLMNR remains on because no one owns name resolution.
• Exceptions that never close: firewall and ASR exclusions added for one migration project become permanent paths across the estate.
• Logon events not collected from workstations: only servers forward logs, so the first hops are invisible and investigators cannot reconstruct the path.

Framework mapping

Practitioner checklist

• Deploy Windows LAPS to every Windows device, including servers, and report coverage.
• Deny network and RDP logon to local administrator accounts and keep UAC remote restrictions on.
• Require SMB signing everywhere and audit, then restrict, NTLM.
• Disable LLMNR and NetBIOS over TCP/IP, and harden AD CS web enrolment against relay.
• Block SMB, RPC, WinRM and RDP between workstations with the host firewall.
• Require Remote Credential Guard for RDP and stop privileged accounts logging on to workstations.
• Treat deployment tools, RMM and cloud consoles as tier zero with just-in-time roles and approval for bulk actions.
• Alert on network logon followed by service, task or WMI execution on the target.
• Run attack path analysis monthly and fix the shortest paths to tier zero.

Standards and references

• MITRE ATT&CK: Lateral Movement (TA0008)
• MITRE ATT&CK: Remote Services: SMB/Windows Admin Shares (T1021.002)
• MITRE ATT&CK: Name Resolution Poisoning and SMB Relay (T1557.001)
• CISA and NSA: NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations
• CISA: Microsegmentation in Zero Trust Part One: Introduction and Planning
• Microsoft Learn: SMB security hardening
• Microsoft Learn: Windows LAPS overview
• Microsoft Learn: Remote Credential Guard

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide · Privileged Access Management Guide · ITDR Guide · Ransomware Prevention Guide · Windows Endpoint Hardening Guide