MITRE ATT&CKtactic
TA0008 Lateral Movement
- Domain
- enterprise
- Version
- 1.1
- Created
- 2018-10-17
Description
The adversary is trying to move through your environment.
Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.
Related
Referenced by MITRE ATT&CK · tactic (23)
- T1021.008 Direct Cloud VM Connections sub-technique
- T1021.007 Cloud Services sub-technique
- T1570 Lateral Tool Transfer technique
- T1563 Remote Service Session Hijacking technique
- T1563.001 SSH Hijacking sub-technique
- T1563.002 RDP Hijacking sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.003 Distributed Component Object Model sub-technique
- T1021.004 SSH sub-technique
- T1021.005 VNC sub-technique
- T1021.006 Windows Remote Management sub-technique
- T1550 Use Alternate Authentication Material technique
- T1550.001 Application Access Token sub-technique
- T1550.002 Pass the Hash sub-technique
- T1550.003 Pass the Ticket sub-technique
- T1550.004 Web Session Cookie sub-technique
- T1534 Internal Spearphishing technique
- T1210 Exploitation of Remote Services technique
- T1021 Remote Services technique
- T1072 Software Deployment Tools technique
- T1080 Taint Shared Content technique
- T1091 Replication Through Removable Media technique