Lateral Movement 16 articles

Overview Active Directory Delegation Abuse is a technique where adversaries exploit delegated permissions within an Active Directory (AD) environment to escalate privileges, maintain persistence, or move laterally. By abusing delegated…

Overview Cloud lateral movement via IAM roles is a technique where adversaries leverage permissions and trust relationships between cloud identities to move within a cloud environment. This method is used…

Overview Container-to-container lateral movement is a technique used by adversaries to move laterally within a containerized environment by exploiting communication channels or vulnerabilities between containers. This technique enables attackers to…

Overview Credential reuse across systems is a technique where adversaries leverage stolen or compromised authentication credentials from one system to gain unauthorized access to other systems or services. This method…

Overview Exploitation of trust relationships involves adversaries leveraging established trust between systems, users, or domains to bypass security controls and gain unauthorized access. This technique is used throughout the attack…

Overview Kerberos Delegation Attacks exploit weaknesses in the Kerberos authentication protocol to impersonate users and access resources on their behalf. These attacks are leveraged during various stages of the attack…

Overview Network Device Lateral Movement is a technique used by adversaries to traverse through an organization's network by compromising and leveraging network infrastructure devices such as routers, switches, firewalls, and…

Overview Pass-the-Hash (PtH) lateral movement is a technique where adversaries use stolen hashed credentials to authenticate to remote systems without needing to know the plaintext password. This method enables attackers…

Overview Pass-the-Ticket (PtT) lateral movement is a technique where adversaries use stolen Kerberos ticket-granting tickets (TGTs) or service tickets (TGSs) to authenticate to other systems within a network without needing…

Overview PowerShell Remoting Abuse is a technique where adversaries leverage legitimate Windows PowerShell remote management capabilities to execute commands or scripts on remote systems. This technique facilitates various stages of…

Overview Remote Desktop Protocol (RDP) Lateral Movement is a technique used by adversaries to move within a compromised network by leveraging RDP sessions to access and control remote systems. This…

Overview Remote Service Exploitation is a technique where adversaries leverage vulnerabilities or misconfigurations in network-accessible services to gain unauthorized access or execute malicious actions. This technique is commonly employed during…

Overview SMB Relay Attacks are a form of man-in-the-middle attack targeting the Server Message Block (SMB) protocol, commonly used for file sharing and inter-process communication in Windows environments. Adversaries leverage…

Overview SSH-Based Lateral Movement is a technique where adversaries leverage Secure Shell (SSH) protocols to move laterally within a network environment. It is commonly used after initial access to expand…

Overview Windows Admin Shares Abuse is a technique where adversaries leverage default administrative network shares on Windows systems to gain unauthorized access and move laterally within a network. These hidden…

Overview WMI-Based Lateral Movement is a technique where adversaries leverage Windows Management Instrumentation (WMI) to move laterally across systems within a network. This method enables attackers to execute commands or…