Identity & Access
Lateral Movement via Identity
Valid credentials are used to hop from system to system inside the network.
What it is
After gaining initial access, attackers use stolen credentials or session tokens to authenticate to additional systems. Remote services (SMB, RDP, WinRM, SSH) are accessed with harvested credentials. Pass-the-ticket reuses Kerberos tickets without needing plaintext passwords. In cloud environments, SAML token forgery and OAuth token theft enable movement across federated services.
Attack techniques
- Remote Services — SMB (T1021.002)
- Remote Services — RDP (T1021.001)
- Pass-the-Ticket (T1550.003)
- WMI Execution (T1047)
- SAML Token Forgery (T1606.002)
- Internal Spearphishing (T1534)
Business impact
Lateral movement turns a single compromised endpoint into full domain compromise. Without segmentation and identity controls, there is no natural barrier stopping an attacker from reaching any system the original account could reach.