Lateral Movement

What it is

Lateral movement is the progression from an initial compromised system or identity to additional systems or accounts. It expands an intrusion toward valuable records, administrative control, or broad disruption. It is distinct from initial access and privilege escalation, although stolen credentials and higher privileges often make movement easier.

How it works

The attacker discovers reachable services and uses credentials, existing trust relationships, or remote administration paths. Shared passwords and broadly privileged sessions can connect otherwise separate machines. Access that looks internal may still be controlled by an adversary.

How people get tricked

Defenders trust traffic because it originates inside the network or uses a valid account. A compromised colleague's machine can satisfy that superficial expectation. User deception may have occurred only at the first foothold, not at each subsequent hop.

Example scenario

An infected workstation contains credentials with access to a file server. The attacker uses them remotely, then finds another administrative path to a more sensitive system.

Warning signs

• Unusual authentication between systems or from unexpected source devices.
• Remote administration outside the account's normal responsibilities.
• One identity accesses many new services in a short period.

If it happens to you

Isolate initial and newly affected systems, revoke stolen credentials, and trace the sequence of access. Do not stop investigation at the first infected workstation. Restore trust across the affected identity and network paths before reconnecting systems.