What Is Lateral Movement?
Lateral movement is how an attacker spreads from the machine they first compromised to the systems they actually want. The initial foothold is almost never the prize — it is a beachhead. Lateral movement is the journey inland, and because it happens inside the network after the perimeter is already breached, it is one of the most important places to catch an attack.
How do attackers move laterally?#
Once inside, attackers reuse the network’s own tools and trust to spread:
- Credential reuse — stolen or cracked passwords that work on other systems.
- Pass-the-hash / pass-the-ticket — reusing authentication material without the password.
- Remote services — RDP, SSH, SMB, WinRM used the way admins use them.
- Exploiting internal services — pivoting through unpatched machines that trust each other.
Each hop usually pairs with privilege escalation: move to a new host, gain more rights, repeat, until reaching the target.
Why is lateral movement a defender’s best opportunity?#
Because it is noisy if you are watching. An attacker crossing your network generates authentication events, new connections between machines that never normally communicate, and unusual protocol use. Two controls turn this into a wall:
| Control | Effect on lateral movement |
|---|---|
| Network segmentation | Fewer machines can reach each other at all |
| Least privilege | Stolen credentials unlock less |
| MFA on internal access | Reused passwords stop working |
| Monitoring east-west traffic | Movement becomes visible |
Lateral movement is the connective tissue of the Cyber Kill Chain. Its network form is covered in lateral movement across networks. More at the Security Fundamentals hub.
Frequently asked questions#
What is lateral movement in a cyberattack?
Lateral movement is the phase where an attacker, having compromised one system, moves through the network to reach more valuable targets. The initial foothold — a workstation, a low-value server — is rarely the goal; lateral movement is how they get from that entry point to the data or systems they actually want.
How do you detect lateral movement?
Watch for unusual internal activity: logins between machines that never normally talk, use of administrative protocols like RDP or SMB at odd times, a single account authenticating across many hosts, and new service creation. Network segmentation makes this traffic stand out, turning lateral movement into a detection opportunity.