Lateral movement
Lateral movement is attacker activity aimed at reaching and controlling other systems in an environment after gaining access, often by using available accounts or remote services.
Moving beyond the first foothold
After gaining access to one system, an attacker may use it to reach others. MITRE ATT&CK groups techniques for entering and controlling remote systems under Lateral Movement. These can use legitimate credentials and remote services as well as tools brought by the attacker.
The distinction from initial access is the starting position: initial access establishes a foothold in the target environment; lateral movement extends access from there. Moving to another system also does not necessarily increase the account’s privileges.
Reading a remote-logon event
A remote logon is normal administrative activity in many environments. To attribute it to an intrusion, connect the source system, destination, account, timing, and resulting activity with the rest of the investigation. The presence of an administration tool alone is not enough.
Keep attempted and successful movement separate. A rejected connection shows an attempt, while a network map shows possible routes. Neither demonstrates that an attacker controlled the destination.
Network segmentation limits reachable routes; least privilege limits what accounts can do across them. Both matter when one compromised system would otherwise provide access to many others.