Lateral Movement Techniques: The MITRE ATT&CK TA0008 Breakdown

Lateral movement techniques are ordinary administrative actions used from the wrong source, by the wrong identity, toward the wrong target.

A defender who looks only for famous tools will miss the movement that matters. RDP, SSH, SMB, remote services, deployment software, tokens, and shared files all support legitimate work. Attackers use the same channels because they already cross security boundaries and usually blend into a large volume of expected activity.

The operating question is not whether PsExec or PowerShell ran. It is whether the source, identity, channel, target, and next action match an approved relationship. Build detections around that five part claim. Then remove the relationships that have no owner or business purpose.

What are lateral movement techniques?

Lateral movement techniques are methods an attacker uses to enter and control another system after gaining an initial foothold. Movement can use a vulnerability, valid credential, stolen token, existing remote session, management platform, shared file, or removable media. The goal is usually more authority, better persistence, or a route to data and control systems.

Movement is a relationship, not a product. A compromised account that can authenticate to 40 servers creates up to 40 possible identity and target edges before anyone runs a remote tool. A management server with fleet access can multiply that reach again. Our lateral movement pillar guide covers the full source, identity, channel, and target model.

Which lateral movement techniques does MITRE ATT&CK track?

The current MITRE ATT&CK Lateral Movement tactic lists nine parent techniques under TA0008. Treat these as behavior families. Each family contains different prerequisites and evidence.

• Exploitation of Remote Services, T1210, uses a flaw in a service reachable after entry.
• Internal Spearphishing, T1534, uses trust in a compromised internal identity to reach another person.
• Lateral Tool Transfer, T1570, copies payloads or tools between systems already inside the environment.
• Remote Service Session Hijacking, T1563, takes over an existing SSH or RDP session.
• Remote Services, T1021, covers RDP, SMB, DCOM, SSH, VNC, WinRM, and related channels.
• Replication Through Removable Media, T1091, carries malicious content across system or network boundaries.
• Software Deployment Tools, T1072, abuses centralized administration to execute across managed systems.
• Taint Shared Content, T1080, plants malicious content where another user or system will execute it.
• Use Alternate Authentication Material, T1550, uses hashes, tickets, access tokens, or session cookies.

Lists help teams name behavior. They do not set priority. Remote Services may be a thousand times more common than removable media in one environment and absent in another. Start with the channels that reach your critical systems, then map the ATT&CK names to the evidence your tools can produce.

What does 2026 incident data say about movement speed?

Mandiant based its March 2026 M-Trends report on more than 500,000 hours of investigations conducted in 2025. The M-Trends 2026 Executive Edition reports that exploits remained the most common initial infection vector at 32 percent. Global median dwell time rose to 14 days, but speed at the other end of the distribution collapsed the response window.

The report measured a median of 22 seconds between opportunistic initial access and handoff to a second threat group in 2025. The comparable interval was more than eight hours in 2022. That is why a technique detection cannot wait for a complete incident narrative. A new remote relationship to a sensitive target deserves a fast identity and source check while the investigation continues.

One recent CISA case makes the sequence concrete. In an advisory published September 23, 2025, CISA reported that actors exploited CVE-2024-36401 on two GeoServers and moved to two other servers. The first exploitation occurred 11 days after disclosure, the second after 25 days, and activity remained undetected for three weeks. The CISA incident response advisory is newer than most technique roundups and exposes the gap they miss: incomplete endpoint coverage and unreviewed alerts can keep a known path open even after a vulnerability is public.

How do attackers abuse remote services?

RDP, SSH, SMB, WinRM, DCOM, VNC, and remote service control are built to cross machines. Attackers need a reachable service plus authentication material or an exploitable defect. The defensive mistake is allowing broad reach and hoping authentication catches everything.

Narrow each service by source, identity, target group, and time. Workstations should not administer arbitrary servers. Server tiers should not initiate remote sessions into unrelated tiers. Privileged accounts should log on only from managed administration systems. Record the rare exceptions and alert when a source appears outside them.

Follow the session. A network logon followed by service creation, task registration, a script interpreter, remote file access, or new outbound communication tells more than the authentication event alone. The pass the hash guide explains how reusable NTLM material turns one local credential exposure into remote access.

Why do stolen credentials and tokens change the detection plan?

Valid material can satisfy normal authentication. Password hashes, Kerberos tickets, OAuth tokens, session cookies, SSH keys, and active remote sessions may bypass the prompts defenders expect to see. Multifactor authentication protects many login paths, but it cannot repair a stolen session that has already passed the challenge.

Collect token issuance and use, ticket behavior, source devices, logon restrictions, session creation, and target privilege. Watch for one identity appearing from a new source, reaching an unusual target set, changing protocol, or acting outside its normal time window. The first event may be legitimate. The sequence often is not.

Restrict where powerful credentials can land. Separate daily work from administration. Use unique local administrator secrets and identities with a short lifetime where the platform permits it. Remove stale sessions after role changes. Protect browser and command line token stores on systems that handle ordinary user content.

How do deployment tools turn one hop into fleet control?

Software deployment, device management, configuration, virtualization, and backup platforms need broad authority. That makes them efficient choke points for operators and attackers. A single accepted command can reach hundreds or thousands of systems without repeating an exploit on each host.

Treat these platforms as critical assets. Separate their identities from ordinary directory administration. Require strong approval for changes with broad scope. Limit management sources, sign packages where supported, preserve audit records outside the managed estate, and alert when a platform targets a new device group.

Simple math shows the exposure. Fifty support accounts that can each administer 20 servers create up to 1,000 account and server edges. Limit each account to four assigned servers and the ceiling falls to 200. That removes 800 possible relationships. The remaining 200 also become easier to baseline because each has a declared purpose.

What makes shared content and tool transfer dangerous?

Shared drives, code repositories, deployment shares, removable media, and administrative file copies move content across trust boundaries. A transferred file is not malicious by definition. Risk rises when a new source writes an executable or script to a shared location, the content is renamed to resemble an approved tool, or another system executes it soon after.

Log writes and reads on important shares. Preserve file hashes and signer information. Restrict who can change startup scripts, build definitions, packages, and login content. Monitor the transition from write to execution across identities and systems. That transition is the behavior the technique name is trying to capture.

What query finds suspicious remote spread?

This Kusto query uses fields documented in the Microsoft DeviceLogonEvents schema. It looks for one account and source address reaching at least five devices in a 15 minute window.

Five is an example threshold, not a standard. A deployment service may reach 500 devices by design. A payroll administrator may have no reason to reach five. Tune by role and target sensitivity, then join process and network activity that followed the logon. Measure how many results analysts can explain with a named change or approved workflow.

Which controls break the most lateral movement techniques?

Remove unnecessary remote reach first. Then narrow accepted identity, protect credential material, reduce standing privilege, isolate management systems, and watch for new relationships. Patch exposed remote services, but do not let the patch queue hide a reusable account that reaches every server.

Test the controls with approved activity. Attempt the remote logon from an ordinary workstation. Confirm that a restricted account cannot create a service on the target. Copy a harmless test file through the channel and verify the expected logs. Use an expired token and confirm rejection. A policy document cannot prove any of those results.

Keep detection and prevention tied to the same relationship. If a firewall change removes workstation access to WinRM, the detection should still alert if the route reappears. If a directory rule restricts an account to four servers, alert on a fifth. That makes drift visible before it becomes an incident.

How should a team organize the work?

Give each remote channel an owner. Identity owns accepted credentials and logon rights. Network teams own route and service exposure. Endpoint teams own process and session evidence. Application and platform owners confirm which relationships the business needs. Security defines detection and verifies that the joined evidence answers the claim.

Review critical paths each week, not every possible logon. Start with domain controllers, deployment platforms, hypervisors, backup systems, secrets stores, and production data. The attack graph guide shows how to turn those relationships into shared choke points instead of separate product queues.

Deep endpoint context with AI driven analysis can help correlate remote events and explain why a sequence is unusual. Keep the source records visible and preserve unknowns. The operator still decides whether the relationship was approved and which team can close it safely.

Frequently asked questions

What is the most common lateral movement technique?

There is no universal winner. Remote services and valid authentication material are common in enterprise cases, but your priority should follow the channels that can reach critical systems in your environment.

Is privilege escalation the same as lateral movement?

No. Privilege escalation gains more authority. Lateral movement gains control of another system or resource. An attacker often alternates between them.

Can network segmentation stop lateral movement?

It can remove remote routes, but identity, cloud, management, and application trust may cross segments. Pair segmentation with logon restrictions, narrow privilege, session controls, and monitoring.

How do you test a lateral movement detection safely?

Use an approved account, source, target, and harmless command in an isolated or controlled scope. Confirm the event chain, alert, owner notification, and containment action. Record what the test did not cover.

The executive takeaway

Choose the ten most sensitive targets. List every source, identity, and remote channel they accept. Remove the relationships without an owner, then alert when any approved relationship changes. Test one credential route and one management platform route this month. A shorter technique list will not protect the business. Fewer usable paths will.