One compromised laptop rarely tells the full story. What actually matters in a red team assessment is what happens next — can that single foothold turn into control over the domain controller, the finance server, or the backup infrastructure? That’s lateral movement, and it’s one of the skills I’ve spent the most time refining over the years because it’s where a red team engagement really proves (or disproves) an organization’s ability to contain a breach.
What Lateral Movement Is
Lateral movement is the set of techniques attackers (and red teamers) use to move from one compromised system to another within a network, using stolen credentials, exploited trust relationships, or remote administration protocols. The goal is almost never the first machine you land on — it’s what that machine can reach.
Why Lateral Movement Matters
Most breaches that make headlines didn’t start with the crown jewels being directly exposed. They started with a phishing email, a single workstation, and then quiet, methodical movement across the network until the attacker reached something valuable. Red team assessments simulate exactly this, and demonstrating lateral movement is often the clearest way to show a client that network segmentation, credential hygiene, and monitoring need improvement.
Authorized Environments Only
Lateral movement techniques should only ever be practiced within a signed red team engagement, your own lab environment, or legal training platforms. Moving between systems you don’t have explicit authorization to access is illegal, regardless of intent.
Prerequisites Before Moving Laterally
Before you can move laterally, you typically need:
- At least one set of valid credentials (plaintext password, NTLM hash, or Kerberos ticket)
- Network visibility into what other hosts exist and what they’re running
- An understanding of trust relationships (which accounts have access to which machines)
This is why post-exploitation activities like credential harvesting and BloodHound enumeration are prerequisites to effective lateral movement — you need to know where you can go before you try to go there.
Core Lateral Movement Techniques
1. Pass-the-Hash
Pass-the-hash lets you authenticate to a remote system using a captured NTLM hash without ever knowing the plaintext password. NTLM’s authentication protocol doesn’t require the plaintext — the hash itself is sufficient.
crackmapexec smb 10.10.10.0/24 -u administrator -H <ntlm_hash>
This checks the hash against every host on the subnet and reports where it grants access, letting you quickly identify your next targets.
2. Pass-the-Ticket
Similar in concept, but for Kerberos. If you’ve extracted a Kerberos ticket (a TGT or TGS) from memory using a tool like Mimikatz, you can inject it into a new session and authenticate as that user without needing their password or hash.
mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::ptt ticket.kirbi
3. Remote Service Execution (PsExec-style)
Tools like PsExec, and its many reimplementations (Impacket’s psexec.py, CrackMapExec’s execution modules), let you run commands on a remote host using valid credentials by creating and starting a temporary Windows service.
psexec.py domain/user:password@10.10.10.5
4. WMI and WinRM
Windows Management Instrumentation and Windows Remote Management are legitimate administrative protocols that are frequently abused for lateral movement because they’re often allowed through internal firewalls and don’t always trigger the same alerts as PsExec-style service creation.
evil-winrm -i 10.10.10.5 -u administrator -H <ntlm_hash>
Evil-WinRM is one of the most commonly used tools here — it gives you an interactive PowerShell-like session over WinRM using either a password or an NTLM hash.
5. Overpass-the-Hash
This technique uses an NTLM hash to request a legitimate Kerberos ticket, effectively converting an NTLM-based credential into a Kerberos one, which can then be used against services that only accept Kerberos authentication.
mimikatz # sekurlsa::pth /user:admin /domain:corp.local /ntlm:<hash> /run:cmd.exe
6. DCOM Lateral Movement
Distributed Component Object Model (DCOM) is another Windows feature that can be abused to execute code remotely, often flying under the radar of defenses focused specifically on WMI or PsExec.
7. SSH Key Reuse (Linux Environments)
On Linux-heavy networks, lateral movement often looks completely different — finding an SSH private key on one host that grants access to another is extremely common, especially in environments where key-based authentication is reused across systems for convenience.
find / -name "id_rsa*" 2>/dev/null
ssh -i id_rsa user@10.10.10.20
Using BloodHound to Plan Lateral Movement
Rather than moving randomly, effective lateral movement is planned. BloodHound, fed data from SharpHound collection, visually maps which users and groups have administrative rights over which machines, and highlights the shortest path to Domain Admin. I always run this early in an Active Directory assessment because it turns lateral movement from guesswork into a targeted plan.
SharpHound.exe -c All --zipfilename loot.zip
Import the resulting zip into BloodHound’s interface, then use the built-in queries (like “Shortest Path to Domain Admins”) to identify exactly which credentials and machines matter most.
A Practical Walkthrough Example
Imagine you’ve compromised a workstation and dumped an NTLM hash for a local admin account that happens to be reused across the network (a common finding). Your next steps look like:
- Run CrackMapExec with that hash across the internal subnet to identify other hosts where it works.
- Confirm access on a file server with the same local admin credentials.
- Use Evil-WinRM to get an interactive session on that server.
- From there, dump credentials again — perhaps a domain account is cached in memory.
- Use BloodHound to check what that domain account has access to.
- Repeat the process, moving methodically toward the identified shortest path to Domain Admin.
This chain — credential reuse enabling lateral movement, followed by fresh credential harvesting at each hop — is exactly how many real-world breaches unfold, which is why demonstrating it in a controlled assessment is so valuable for clients.
Common Mistakes and Troubleshooting
- Moving without a plan. Randomly trying credentials against every host on the network is noisy and inefficient; use BloodHound or manual enumeration to prioritize targets.
- Ignoring detection risk. PsExec-style service creation is heavily monitored in mature environments; understand what each technique looks like from a defender’s perspective before using it.
- Reusing the same credential too broadly. Hammering one account against many hosts can trigger account lockout policies — always check the domain’s lockout threshold first.
- Not accounting for Kerberos vs NTLM restrictions. Some environments disable NTLM entirely, meaning pass-the-hash techniques won’t work and you’ll need ticket-based approaches instead.
- Forgetting to clean up sessions and artifacts. Remote sessions and dropped tools should be closed and removed as part of a professional engagement.
Security Risks and Defensive Recommendations
- Disable NTLM where possible and enforce Kerberos-only authentication.
- Implement Local Administrator Password Solution (LAPS) so local admin credentials aren’t reused across machines.
- Segment networks so a compromised workstation can’t directly reach servers holding sensitive data.
- Monitor for anomalous authentication patterns, especially a single account authenticating to many hosts in a short window.
- Restrict and monitor WinRM, WMI, and PsExec-style remote execution to only necessary administrative hosts.
- Deploy tiered administration models (Microsoft’s Enterprise Access Model) to prevent credential exposure from cascading across privilege tiers.
Frequently Asked Questions
1. What’s the difference between pass-the-hash and pass-the-ticket? Pass-the-hash uses a captured NTLM hash to authenticate, while pass-the-ticket uses a captured Kerberos ticket — both avoid needing the plaintext password but apply to different authentication protocols.
2. Is lateral movement only relevant to Windows networks? No — Linux environments have their own lateral movement paths, often through SSH key reuse, shared service accounts, or misconfigured trust relationships between hosts.
3. Why is BloodHound so central to lateral movement planning? It converts a complex web of Active Directory permissions into a visual map, letting you identify the most efficient path to a high-value target instead of guessing.
4. How do defenders typically detect lateral movement? Through anomalous authentication logging, unusual process creation on remote hosts (like service creation from PsExec), and behavioral analytics flagging accounts accessing unusual systems.
5. What’s the safest technique to start with in a Windows environment? WinRM via Evil-WinRM is often less noisy than PsExec-style service creation, though the “safest” choice always depends on what the target environment specifically monitors.
6. Can lateral movement happen without any malware or custom tools? Yes — many techniques rely entirely on legitimate administrative protocols and stolen credentials, which is part of what makes lateral movement so hard to detect.
7. What should I do if account lockout policies are aggressive? Slow down credential testing, prioritize confirmed credentials over spraying, and always check the domain password policy before attempting authentication against multiple accounts.
Conclusion
Lateral movement is where a red team assessment demonstrates real organizational risk — showing not just that a single system can be compromised, but how far an attacker could realistically go from there. Whether through pass-the-hash, pass-the-ticket, remote execution protocols, or simple credential reuse, the underlying discipline is the same: plan methodically, use BloodHound or careful enumeration to prioritize targets, and move quietly enough to reflect a realistic adversary. Practice these techniques in an authorized lab, and always operate strictly within your engagement’s defined scope.
