Red-Teaming
Lateral Movement
MITRE ATT&CK™ Lateral Movement - Tactic TA0008
Theory
Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.
Resources
Lateral Movement, Tactic TA0008 - Enterprise | MITRE ATT&CKattack.mitre.orgDCOM>-DNS TunnelingMITRE ATT&CK™ Protocol Tunneling - Technique T1572HTTP(s) TunnelingMITRE ATT&CK™ Protocol Tunneling - Technique T1572Port ForwardingMITRE ATT&CK™ Protocol Tunneling - Technique T1572Remote WMIMITRE ATT&CK™ Windows Management Instrumentation - Technique T1047Scheduled Tasks (ATSVC)Services (SVCCTL)SMB-basedMITRE ATT&CK™ Remote Services: SMB/Windows Admin Shares - Technique T1021.002SSH TunnelingMITRE ATT&CK™ Protocol Tunneling - Technique T1572TLS Tunneling (Ligolo-ng)MITRE ATT&CK™ Protocol Tunneling - Technique T1572WinRM>-