Most intrusions do not reach their objective from the first machine they land on, and the Lateral Movement tactic (TA0008) covers how adversaries get from that foothold to the systems that matter. MITRE ATT&CK v20 describes the tactic as the adversary "trying to move through your environment", often by "pivoting through multiple systems and accounts", and notes that legitimate credentials with native network and operating system tools "may be stealthier" than the adversary's own remote access tools. That observation is the core of defending this tactic: lateral movement is mostly authentication. This hub covers all 9 techniques and 14 sub-techniques, ranks where to start, shows how real campaigns moved across Active Directory, cloud and SaaS, and sets out detection and hardening priorities. It links to each technique guide for depth and is written for SOC analysts, identity engineers and network security teams.
Key takeaways
- Lateral movement is an identity problem first. Remote Services (T1021) and Use Alternate Authentication Material (T1550) account for 241 of the 387 procedure records in ATT&CK v20, and both depend on a credential, hash, ticket, token or cookie.
- SMB and RDP still lead. SMB/Windows Admin Shares (T1021.002, 67 records) and Remote Desktop Protocol (T1021.001, 66) top the data, followed by Lateral Tool Transfer (T1570, 55).
- Cloud and hybrid paths are now routine. Campaigns move from on-premises directories to cloud tenants through sync accounts and federation, and from cloud consoles back to virtual machines (T1021.007, T1021.008).
- Account controls beat network controls in the mapping. Privileged Account Management (M1026) mitigates 13 of the 23 techniques, more than Network Segmentation (M1030, 7).
- Detect logons in context. Event ID 4624 with logon type, source host and account tier, joined to what happens next on the target, separates administrators from adversaries better than any single signature.
What the tactic covers and how the numbers were counted
Lateral Movement in ATT&CK is the act of entering and controlling a remote system, not discovering it (that is Discovery) or stealing the credential (that is Credential Access). In practice the three run as a loop: find a target, obtain material that authenticates to it, connect, repeat.
Figures on this page come from the ATT&CK v20.0 Enterprise STIX bundle. We counted every technique and sub-technique with the lateral-movement phase (revoked and deprecated objects excluded) and every "uses" relationship from groups, software and campaigns to them: 23 entries (9 techniques, 14 sub-techniques), 387 procedure records, 79 groups, 108 software entries and 20 campaigns. Procedure counts reflect public reporting, which favours Windows and well-studied malware, so treat them as a coverage guide rather than a risk ranking.
Every technique in the tactic
| Technique | Sub-techniques | Procedure records | Movement relies on |
|---|---|---|---|
| T1021 Remote Services | .001 Remote Desktop Protocol, .002 SMB/Windows Admin Shares, .003 Distributed Component Object Model, .004 SSH, .005 VNC, .006 Windows Remote Management, .007 Cloud Services, .008 Direct Cloud VM Connections | 198 | Valid credentials on a remote service |
| T1072 Software Deployment Tools | None | 12 | Access to a management console or agent (also Execution) |
| T1080 Taint Shared Content | None | 12 | Write access to shared drives, repositories or SaaS storage |
| T1091 Replication Through Removable Media | None | 28 | Removable drives moving between systems (also Initial Access) |
| T1210 Exploitation of Remote Services | None | 26 | A vulnerable internal service, no credential needed |
| T1534 Internal Spearphishing | None | 9 | A compromised mailbox or chat account trusted by colleagues |
| T1550 Use Alternate Authentication Material | .001 Application Access Token, .002 Pass the Hash, .003 Pass the Ticket, .004 Web Session Cookie | 43 | Hashes, Kerberos tickets, OAuth tokens or session cookies |
| T1563 Remote Service Session Hijacking | .001 SSH Hijacking, .002 RDP Hijacking | 4 | An existing session of another user |
| T1570 Lateral Tool Transfer | None | 55 | A file transfer path between internal hosts |
Seven of the nine techniques need some form of authentication or trusted account. Only T1210 and T1091 move without one, which is why credential hygiene and logon monitoring cover most of the tactic. For a discipline overview of the topic see the Lateral Movement Guide.
Where to start: ranked techniques for defenders
- T1021.002 SMB/Windows Admin Shares and T1570 Lateral Tool Transfer: the classic pair, a file written to ADMIN$ and then run as a service or task. High volume and well logged (Event IDs 5140 and 4624 type 3, Sysmon 11). See the SMB Protocol Security and Signing Guide.
- T1021.001 Remote Desktop Protocol: used by Volt Typhoon to reach a domain controller with a domain administrator account, and by many ransomware crews. Restrict who can RDP to what. See the Remote Desktop (RDP) Security Guide.
- T1550 Use Alternate Authentication Material: Pass the Hash (22 records) on premises, and application access tokens and session cookies in the cloud. This is where MFA stops helping, because the material is already authenticated. See the Pass-the-Hash and Pass-the-Ticket Guide.
- T1021.007 Cloud Services and T1021.008 Direct Cloud VM Connections: few records, but they connect on-premises compromise to tenant compromise. Treat console and CLI logons by synced or federated accounts as lateral movement.
- T1021.006 Windows Remote Management and T1021.004 SSH: native administrative channels; baseline which hosts legitimately initiate them. See the Windows Remote Management and WinRM/PowerShell Remoting Security Guide and the SSH Key Management Guide.
- T1072 Software Deployment Tools: one compromised console reaches every managed host. Low volume, very high blast radius.
- T1210 Exploitation of Remote Services: handled mainly through patching and segmentation of internal services, with crash-and-child-process detection as a backstop.
How campaigns move: AD, cloud and SaaS chains
ATT&CK v20 maps 20 campaigns to this tactic. The patterns repeat across very different actors.
- SolarWinds Compromise (C0024, 6 lateral movement techniques): APT29 used RDP from public-facing systems to internal servers (T1021.001), administrative accounts over SMB (T1021.002) and WinRM through PowerShell (T1021.006). In the cloud it used forged SAML tokens to impersonate users and bypass MFA (T1550), compromised service principals to change the Office 365 environment (T1550.001) and stolen cookies, including a forged duo-sid cookie, to bypass MFA on an email account (T1550.004). One campaign, one playbook, both planes. The SolarWinds supply chain compromise page covers the identity side.
- Storm-0501 hybrid attacks: Microsoft reported the group moving on premises with Cobalt Strike to Domain Admin and domain controllers, then locating Entra Connect Sync servers and extracting credentials for the Directory Synchronization Accounts account. In one case a Domain Admin's cloud counterpart held Global Administrator with MFA disabled, so a password reset gave cloud control. See the Storm-0501 hybrid cloud attacks and the Microsoft Entra Connect and Cloud Sync Hardening Guide.
- Scattered Spider (G1015) and C0027: ATT&CK records SSH to move laterally and reach the vCenter Server GUI (T1021.004), compromised Azure credentials used for lateral movement to on-premises systems (T1021.007) and pre-existing AWS EC2 instances used for lateral movement and collection.
- Cutting Edge (C0029): after exploiting Ivanti Connect Secure, actors used compromised VPN accounts with RDP, SMB and SSH to reach internal systems.
- C0018 (AvosLocker): actors used PDQ Deploy to push ransomware and tools across the network (T1072) and AnyDesk to transfer tools (T1570), a reminder that deployment and remote access tools are lateral movement infrastructure.
The Change Healthcare breach shows the time window defenders have: attackers logged in to a Citrix portal without MFA on 12 February 2024, moved and exfiltrated for about nine days, and deployed ransomware on 21 February.
Where non-human identities fit
Service accounts, sync accounts, deployment agents and OAuth applications are the quiet highways of lateral movement. They authenticate to many systems by design, are often exempt from MFA, and their logons look routine. The Entra Connect sync account in the Storm-0501 case, PDQ Deploy in C0018 and the service principals in the SolarWinds campaign all carried the adversary between systems. Map where each high-privilege machine identity is allowed to log on from and to, alert when that changes, and prefer workload identity federation and short-lived tokens over long-lived secrets. Token replay (T1550.001) inside Kubernetes and cloud workloads is covered in the MITRE ATT&CK T1550 Use Alternate Authentication Material Guide.
Detection priorities across the tactic
| Technique | v20 detection strategy | Log sources named | What to alert on |
|---|---|---|---|
| T1021.001 RDP | DET0327 | Security Event IDs 4624, 4648, 4778, 4779; Sysmon Event IDs 1, 3, 22 | RDP logons by tier 0 accounts to non-tier 0 hosts, or from workstations to servers outside admin jump hosts |
| T1021.002 SMB/Admin Shares | DET0530 | Security Event IDs 4624, 4648; Sysmon Event IDs 1, 3, 22 | ADMIN$ or C$ access followed by service or task creation on the target |
| T1021.006 WinRM | DET0477 | Security Event IDs 4624, 4648; WinRM Event ID 6; Sysmon Event ID 1; inbound 5985/5986 | wsmprovhost.exe spawning shells on hosts that are not management targets |
| T1021.007 Cloud Services | DET0008 | CloudTrail ConsoleLogin, AssumeRole; Okta user.authentication.sso, app.oauth.grant; Microsoft 365 UserLoggedIn | Console or CLI logon from an atypical location followed by enumeration or permission changes |
| T1550.002 Pass the Hash | DET0409 | Security Event IDs 4624, 4648, 4768; Sysmon Event IDs 1, 3 | NTLM logon type 3 by privileged accounts with no matching Kerberos activity |
| T1550.003 Pass the Ticket | DET0352 | Security Event IDs 4768, 4769, 4624; Sysmon Event IDs 7, 10 | Service ticket requests with no prior TGT request from that host |
| T1550.001 Application Access Token | DET0185 | CloudTrail AssumeRole, GetFederationToken, AssumeRoleWithWebIdentity; Entra sign-in logs; Kubernetes API server audit | Tokens used from new clients, regions or outside the workload they were issued to |
| T1570 Lateral Tool Transfer | DET0183 | Security Event ID 5140; Sysmon Event IDs 1, 11; auditd execve for scp, rsync, curl | Executables written to admin shares or temp paths and run shortly after |
| T1072 Deployment Tools | DET0223 | Security Event ID 4688, SCCM and Intune logs, AWS SSM RunCommand in CloudTrail, Jamf remote commands | Deployments outside change windows or from unusual admin accounts |
Join these to identity context. A logon is only suspicious relative to who normally does it from where; an ITDR or UEBA layer that knows account tier and normal source hosts removes most false positives. See the Active Directory Security Monitoring and Event IDs Guide and the ITDR Guide.
Metrics that show it is working
- Tier violations: count per week of tier 0 credentials used on lower-tier hosts, trending to zero.
- Local admin uniqueness: share of Windows devices with a LAPS-managed local administrator password.
- East-west exposure: share of workstations that can reach other workstations on 445, 3389 and 5985.
- Time to contain: median time from first lateral movement alert to host isolation and credential revocation.
- Emulation pass rate: share of lateral movement tests (PsExec-style service creation, WinRM, pass the hash) detected within 15 minutes.
Mitigation priorities
Counting "mitigates" relationships in v20 for the 23 techniques gives this order.
| Mitigation | Techniques mapped in TA0008 | Practical form |
|---|---|---|
| M1026 Privileged Account Management | 13 | Tiered administration: tier 0 accounts never log on to workstations; admin workstations for privileged work. See the Tiered Administration and Enterprise Access Model Guide. |
| M1042 Disable or Remove Feature or Program | 12 | Turn off unused remote services (WinRM, RDP, SMBv1, VNC) where not needed |
| M1018 User Account Management | 10 | Restrict "Allow log on through Remote Desktop Services" and remote logon rights to named groups |
| M1027 Password Policies | 7 | Unique local admin passwords through Windows LAPS; long random service account passwords |
| M1030 Network Segmentation | 7 | Block workstation-to-workstation 445, 3389 and 5985/5986; admin protocols only from jump hosts. See the Network Segmentation Guide. |
| M1047 Audit | 6 | Review who holds remote logon and deployment rights |
| M1032 Multi-factor Authentication | 5 | MFA on remote access, jump hosts and cloud consoles; it does not stop replay of already issued tokens |
| M1035 Limit Access to Resource Over Network | 4 | Remote Desktop Gateway, conditional access on cloud admin portals |
Windows LAPS gives each device a unique, regularly rotated local administrator password backed up to Entra ID or Active Directory, which Microsoft describes as protection against pass-the-hash and lateral-traversal attacks. It is built into supported Windows versions. See the Local Administrator Password Solution (LAPS) Guide and, for the full catalogue, the ATT&CK Mitigations hub.
Phased rollout
- Map admin paths: which accounts log on to which hosts over which protocols, including service and sync accounts.
- Collect the logs: Security Event IDs 4624, 4648, 4768, 4769, 4778, 5140 from domain controllers and servers; Sysmon network events; cloud sign-in and CloudTrail logs.
- Remove shared local admin passwords: deploy Windows LAPS in a pilot OU, confirm help desk retrieval works, then expand.
- Block east-west admin protocols in audit first: log host firewall drops for 445, 3389 and 5985 between workstations for two weeks, fix legitimate flows, then enforce by ring with a firewall policy rollback ready.
- Enforce tiering: deny logon rights for tier 0 accounts on lower tiers through user rights assignment, starting with domain admins.
- Harden hybrid links: treat Entra Connect servers and federation servers as tier 0; require MFA and remove permanent Global Administrator from synced accounts.
Decision guidance
- Segmentation or identity first: where credentials are already unique and tiered, segmentation adds real friction; where local admin passwords are shared, fix that first, because segmentation will have gaps.
- Small organisations: Windows LAPS, host firewall rules blocking workstation-to-workstation traffic and MFA on remote access cover most of the tactic with no new products.
- Large or hybrid estates: invest in identity-aware detection that spans AD and cloud logs, because the most damaging paths cross between them.
Common failure patterns
- One local admin password everywhere: a single hash opens every workstation.
- Domain admins on workstations: privileged credentials cached where any user-level compromise can reach them.
- Remote access without MFA: a single stolen password at the edge leads to days of internal movement, as at Change Healthcare.
- Synced admin accounts in the cloud: on-premises compromise flows straight into Global Administrator.
- Deployment and RMM consoles outside tier 0: one console login pushes code to every host. See the RMM Tool Security Guide.
- Password reset as the whole response: tickets, refresh tokens and session cookies keep working after the reset.
Framework mapping
| Framework | Relevant references |
|---|---|
| NIST SP 800-53 Rev. 5 | AC-17 Remote Access, AC-6(5) Privileged Accounts, AC-2(7) Privileged User Accounts, SC-7 Boundary Protection, SI-4 System Monitoring, CM-7 Least Functionality |
| NIST CSF 2.0 | PR.AA-05 access permissions managed, PR.IR-01 networks protected from unauthorised logical access, DE.CM-01 networks monitored, DE.CM-03 personnel activity monitored |
| CIS Controls v8.1 | Control 4 Secure Configuration, Control 5 Account Management, Control 6 Access Control Management, Control 12 Network Infrastructure Management, Control 13 Network Monitoring and Defense |
| MITRE D3FEND | D3-RTSD Remote Terminal Session Detection, D3-NI Network Isolation, D3-LAM Local Account Monitoring, D3-NTA Network Traffic Analysis |
Practitioner checklist
- Deploy Windows LAPS to every Windows device and confirm no two devices share a local admin password.
- Deny tier 0 account logons to workstations and member servers through user rights assignment.
- Block workstation-to-workstation SMB, RDP and WinRM at the host firewall.
- Alert on ADMIN$ writes followed by service or task creation, and on RDP by privileged accounts outside jump hosts.
- Hunt for NTLM logon type 3 by privileged accounts and for service tickets with no prior TGT.
- Treat Entra Connect, federation, deployment and RMM servers as tier 0 and monitor their logons.
- Remove permanent Global Administrator from synced accounts and require MFA on all cloud admin roles.
- Include token, ticket and session revocation in the lateral movement response playbook.
- Run quarterly lateral movement emulation and track the detection pass rate.
Standards and references
- MITRE ATT&CK: Lateral Movement (TA0008)
- MITRE ATT&CK: Remote Services (T1021)
- MITRE ATT&CK: Use Alternate Authentication Material (T1550)
- MITRE ATT&CK: SolarWinds Compromise (C0024)
- Microsoft Learn: What is Windows LAPS?
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- MITRE D3FEND: Knowledge graph
Related NHI Mgmt Group resources: Lateral Movement Guide · Pass-the-Hash and Pass-the-Ticket Guide · Session Hijacking and Cookie Theft Guide · ATT&CK Credential Access Tactic Guide · ATT&CK Mitigations