Definition
Lateral movement refers to the techniques attackers use to navigate and access different systems within a compromised network after gaining initial entry. It involves exploiting legitimate credentials or vulnerabilities to move from one compromised host to another, expanding their reach and control. This process allows attackers to escalate privileges, discover sensitive data, and establish persistence within the target environment. Attackers often use tools like PsExec or PowerShell Remoting to execute commands on remote machines, effectively moving sideways across the network. Understanding lateral movement is crucial for defenders to detect and prevent attackers from achieving their ultimate objectives, such as data exfiltration or system disruption. A common example is an attacker using stolen administrator credentials from a workstation to access a file server. This differs from initial access, which is the first point of entry into the network. Concepts of lateral movement are frequently tested on cybersecurity certifications like CompTIA Security+ and CySA+.