Lateral movement in the Windows environment

There are many techniques for further propagation through the network, and the choice in any given situation depends on a preliminary discovery, during which threat actors get all the information they need. Discovery of key assets, for example, provides adversaries with information about which hosts they need to access. Examining information about network services and installed software will help them understand what network propagation options are available to them and whether they can leverage those services or use existing software to distribute the tools they need. As for the necessary credentials, these can also be mined either during the discovery or at earlier stages.

Thus, by the time of propagation, adversaries should have all the necessary information and a clear understanding of their ability to propagate in a particular infrastructure using the available credentials. For example, if threat actors have successfully accessed...