Performing lateral movement

Lateral movement can be carried out using different techniques and tactics. Attackers utilize them to move within the network from one device to the other. Their aim is to strengthen their presence in a network and to have access to many devices that either contains valuable information or are used to control sensitive functions such as security.

The following illustration shows where lateral movement sits in the Cyber Kill Chain:

Figure 6: Lateral movement within Cyber Kill Chain

We can divide lateral movement into 2 stages:

Stage 1 - User Compromised (User Action)

This is the stage where the user action can allow an attacker to start running their code. The attacker can reach this stage via traditional security mistakes such as socially engineering the victim to click a phishing link in email but can also include visiting a legitimate website that has already been compromised by an attacker. (Like the iPhone Zero Day attack that was...