Lateral Movement in Domain and Across Forests

After an adversary establishes a foothold in the environment and/or harvests valid credentials, the next step is usually lateral movement. Lateral movement is a set of techniques that allows an attacker to move deeper into the target environment and search for high-value assets and sensitive data, including new credentials.

We will start with a scenario in which an attacker obtained a clear-text password (e.g., successful password spray attack) and now tries to blend in with usual environment traffic by abusing administrative protocols. As a next step, we will discuss how to relay the hash and the prerequisites for this move to be successful. To perform lateral movement, the attacker does not only require an New Technology LAN Manager (NTLM) response or clear-text password; it can be any other form of credential material: NT hash, key, or ticket. As Kerberos is recommended by Microsoft as the primary secure authentication protocol in...