Summary

In order to develop an attack and achieve their goals, threat actors need to spread across the network. This allows them to gain more of the information they need, access key assets, and expand their capabilities.

While there is a wide variety of techniques to travel through the network, the choice of technique often depends on what methods of accessing the infrastructure are being used at that point and what information adversaries have already managed to extract from compromised hosts. In addition, the methods of propagation and destination hosts will be based on the motivation of the threat actors.

Moving around the network itself promotes cycling through the intermediate stages of the attack, as moving from host to host gives adversaries more opportunities to extract new authentication data, discover sensitive information, and propagate to hard-to-reach network segments and key assets. If threat actors are interested in collecting and extracting data from the victim...