Lateral Movement.

What is lateral movement?

Lateral movement is what an attacker does after getting a first foothold: moving from one system or account to others inside the same network. In MITRE ATT&CK, it is a tactic, which means a goal an attacker is working toward. MITRE describes it as the adversary trying to move through your environment.

How does lateral movement work?

MITRE says lateral movement techniques cover entering and controlling remote systems. It says the attacker often has to explore the network to find the target, then pivot through multiple systems and accounts to reach it. Pivoting means using one compromised system as a step to reach the next.

MITRE also says adversaries may install their own remote access tools. They may instead use legitimate credentials with the native network and operating system tools, which MITRE notes may be stealthier.

What does it look like in simple terms?

This is a simple illustration, not a real case.

• 1. An attacker gains access to one machine or account.
• 2. They explore the network to find where the target sits.
• 3. They log in to other systems, often with valid accounts.
• 4. They repeat the steps until they reach the target.

Which techniques are used?

MITRE lists nine techniques under this tactic, including Remote Services, Remote Service Session Hijacking, Software Deployment Tools, Lateral Tool Transfer and Use Alternate Authentication Material. For Remote Services, MITRE says adversaries may use Valid Accounts to log in to a service that accepts remote connections, such as telnet, SSH and VNC.

How can you detect and reduce it?

MITRE describes network segmentation as dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems and applications. It lists this as a way to restrict lateral movement by adversaries.

For remote services, MITRE lists these mitigations:

• Disable or remove remote services that are not needed.
• Prevent unnecessary remote access to file shares, hypervisors and sensitive systems.
• Require multi-factor authentication for remote service logons.
• Do not reuse local administrator passwords across systems, and keep passwords complex and unique.
• Limit the accounts that may use remote services, and limit permissions for accounts at higher risk.

For detection, MITRE suggests watching for logons by RDP or WMI followed by uncommon command execution, file manipulation or lateral network connections. It also suggests watching for SSH sessions from a new source IP followed by an interactive shell or privilege escalation.

Is lateral movement the same as initial access?

No. MITRE describes Initial Access as the adversary trying to get into your network, for example through targeted spearphishing or by exploiting a public-facing web server. Lateral movement is what can follow, when the adversary moves through the environment. Both are separate tactics in the MITRE ATT&CK framework.

Is lateral movement the same as privilege escalation?

No. Lateral movement is about moving through the environment to other systems and accounts. MITRE describes Privilege Escalation as the adversary trying to gain higher-level permissions, noting that adversaries can often enter and explore a network with unprivileged access but need elevated permissions to follow through on their objectives. The two can appear together: one MITRE detection idea for remote services is an SSH session from a new source IP followed by privilege escalation.

Related terms

Related terms are MITRE ATT&CK, persistence and tactics, techniques and procedures.