Performing lateral movement

Lateral movement can be carried out using different techniques and tactics. Attackers utilize them to move within the network from one device to the other. Their aim is to strengthen their presence in a network and to have access to many devices that either contain valuable information or are used to control sensitive functions such as security.

The illustration shows where lateral movement sits in the Cyber Kill Chain:

Figure 8.6: Lateral movement within Cyber Kill Chain

We will divide lateral movement into 2 stages: user compromised, and workstation admin access.

Stage 1 – User compromised (user action)

This is the stage where the user action can allow an attacker to start running their code. The attacker can reach this stage via traditional security mistakes, such as socially engineering the victim to click a phishing link in an email, but it can also include visiting a legitimate website that has already been compromised...