Lateral movement

A foothold can become access elsewhere

Lateral movement is activity that extends access from an initial foothold to other systems or identities inside an environment. An actor may use remote services, available credentials, exploited weaknesses, or existing trust relationships. The important feature is movement across resources, rather than merely running another command on the original device.

The movement does not have to follow a neat sequence of physical computers. An endpoint session might lead to a cloud identity, which can assume a role with access to another account. Investigations should follow authority and reachable resources as well as network addresses.

Follow the identity across systems

In a fictional company, a staff laptop is compromised. Shortly afterward, a privileged account authenticates from that laptop to a file server, and the server starts an unexpected process. The sequence suggests a path worth investigating, but it must be supported with identity, remote-access, and endpoint evidence.

The analyst checks whether the account was legitimately used by an administrator, which service handled the connection, and whether the target records show authentication, command execution, or only an unsuccessful attempt. Shared addresses and reused usernames can make careless joins misleading.

Remote Services describes one common access route. Exploitation of Remote Services covers a different situation in which a service weakness is used to reach an internal target. Distinguishing them matters because resetting credentials does not fix an exploitable service, while patching a service does not invalidate every stolen credential.

Bound the possible spread

Build a list of resources the affected identities could reach, then prioritize searches using observed behavior and business impact. Do not assume that the first visibly affected host is the origin or the only target. Record where telemetry is available and where the team lacks sufficient evidence to rule activity in or out.

Network segmentation can restrict reachable paths, while Least privilege reduces the authority available after an account is abused. Neither control should be credited with preventing movement unless its actual enforcement and coverage support that conclusion.

Containment may require coordinated identity and device actions. Isolating the first laptop can be useful, but a session already established on another server may need separate attention. Review response effects across the observed path.

Practice reconstructing the route

Create a fictional timeline with three systems, two identities, and one legitimate maintenance action. Mark authentication events separately from execution events. Draw only the connections the evidence supports, and label uncertain links as hypotheses.

Then remove one target's endpoint records and explain how that changes the conclusion. The exercise teaches that a plausible route is not the same as a proven route. Log correlation helps connect events, while Incident reporting and handover makes the resulting scope and limitations clear.

Related concepts

• MITRE ATT&CK