What is lateral movement in cybersecurity?

Lateral movement is the set of techniques an attacker uses to pivot from an initial foothold to other systems inside the network, escalating privileges and reaching high-value targets.

How does micro-segmentation stop lateral movement?

Micro-segmentation enforces identity-aware allow-lists between workloads, so even a valid credential cannot reach systems outside its declared business service. The blast radius collapses to a single segment.

What are the most common lateral movement techniques?

Pass-the-Hash, Pass-the-Ticket, Kerberoasting, RDP and SSH hijacking, SMB / admin-share abuse, WMI and PsExec remote execution, and exploitation of trust relationships between domains.

Lateral movement techniques, and how to contain them

Almost every ransomware incident and high-impact breach in the last five years has the same middle act: an attacker lands somewhere unimportant, then quietly walks across the network until they're standing on something that matters. That walk is lateral movement. This guide explains the techniques attackers actually use, how to spot them, and why micro-segmentation is the control that finally makes the walk impossible.

What is lateral movement?

Lateral movement is the post-compromise stage where an attacker pivots from their initial foothold to other systems inside the network. They reuse legitimate credentials, abuse built-in admin protocols, and chain trust relationships, all to reach the few assets the business actually depends on: domain controllers, backup infrastructure, the crown-jewel database, the payments switch.

It is the stage where dwell time is highest and detection is weakest, because every action looks like a normal admin doing normal work. The attacker is not exploiting a CVE here. They are using Windows the way Windows is meant to be used.

The five stages of a breach

1
Foothold
Phishing, exposed RDP, vulnerable edge service. One workstation or service account is compromised.
2
Discovery
Attacker enumerates AD, shares, and reachable services from the foothold to map what's adjacent.
3
Credential access
LSASS dumps, Kerberoasting, token theft. Collecting material to authenticate elsewhere as a legitimate user.
4
Lateral movement
Reusing those credentials over SMB, RDP, WMI, or Kerberos to reach the next host. Repeats until reaching tier-0.
5
Impact
Data exfiltration, ransomware detonation across the blast radius, or destruction of backups.

Stage 4 is where the blast radius is decided. Containment controls applied here change the entire outcome.

Common lateral movement techniques

Mapped to MITRE ATT&CK. For each, we cover what the attacker is doing, what it looks like in your telemetry, and how a labeled, micro-segmented network removes the technique's leverage.

Pass-the-Hash (PtH)

MITRE T1550.002

What it is: Attacker reuses an NTLM hash captured from memory (LSASS) to authenticate as a user without ever cracking the password.
Signal: Anomalous NTLM auth from a workstation to multiple servers; identical logon events across hosts in seconds.
How segmentation contains it: Deny workstation-to-workstation SMB. Only allow auth flows from endpoints to the specific app servers their owner uses.

Pass-the-Ticket (PtT)

MITRE T1550.003

What it is: Stolen Kerberos TGT or service ticket is replayed from another host to impersonate the user.
Signal: Same TGT used from two source IPs; tickets with unusual lifetimes or encryption types (RC4).
How segmentation contains it: Pin service access to a small set of source segments. Block east-west KDC traffic from user subnets to tier-0 assets.

Kerberoasting

MITRE T1558.003

What it is: Attacker requests service tickets for accounts with SPNs, then cracks the RC4-encrypted ticket offline to recover the service account password.
Signal: Single account requesting many distinct SPN tickets in a short window; RC4 tickets where AES is expected.
How segmentation contains it: Block direct access to KDC from non-admin segments. Confine service accounts to a single business-service segment so a cracked password buys nothing outside it.

RDP / SSH hijacking

MITRE T1021.001

What it is: Attacker uses harvested credentials or session tokens to open interactive sessions on adjacent servers.
Signal: RDP/SSH from unusual source segments; logons outside working hours; jump from a workstation directly to a database host.
How segmentation contains it: Allow RDP/SSH only from named jump hosts to declared targets. Deny everything else by default.

SMB / admin-share abuse

MITRE T1021.002

What it is: Attacker mounts ADMIN$ / C$ on neighbouring machines to drop binaries and execute them remotely.
Signal: SMB writes to ADMIN$ or C$ between peer workstations; new services registered remotely.
How segmentation contains it: Workstation-to-workstation SMB should be flat-out denied. Server SMB allowed only between the file servers and their declared clients.

WMI / PsExec remote execution

MITRE T1047 / T1569.002

What it is: Living-off-the-land remote code execution over DCOM/WMI or the SCM, hard to detect because it uses signed Windows tooling.
Signal: wmic process call create or PSEXESVC service installs across multiple hosts from a single source.
How segmentation contains it: Block DCOM (TCP 135 + dynamic RPC) east-west outside admin tier. Allow PsExec patterns only from approved admin jump hosts.

Exploiting trust relationships

MITRE T1199

What it is: Attacker pivots through trusted third-party VPN tunnels, contractor laptops, OT/IT bridges, or domain trusts.
Signal: Inbound flows from partner ranges hitting assets outside the documented integration scope.
How segmentation contains it: Treat every trust as a labeled segment with explicit allow-lists. Default-deny any flow the partner integration does not declare.

Why traditional controls miss it

Perimeter firewalls see north-south traffic. Lateral movement is east-west and never crosses the perimeter.
EDR alerts on the host, but a legitimate logon with a stolen ticket looks identical to the real user.
MFA protects the front door. Once the attacker has Kerberos tickets, MFA is not re-evaluated.
VLAN segmentation is coarse. Inside a flat VLAN, everything talks to everything.

Containment: the segmentation playbook

Micro-segmentation works because it reverses the default. Instead of "allow anything not explicitly blocked", every workload publishes the small set of flows it actually needs, and the fabric denies the rest, regardless of who the credentials belong to.

Label every asset by business service and tier. You cannot contain a network you cannot describe.
Default-deny east-west between business services. The asset's job decides what it can talk to.
Ring-fence tier-0 (domain controllers, backups, KDCs). Only admin jump hosts may reach them.
Kill workstation-to-workstation SMB, RDP and WMI outright. No legitimate user needs them.
Test by replaying breaches against the policy before an attacker does. Confirm the blast radius is one segment, not the whole estate.

See containment in action

Breach Ready is an interactive demo that lets you replay real-world lateral movement scenarios (Pass-the-Hash, Kerberoasting, RDP hijacking) against a regional bank's network, with and without micro-segmentation. Watch the blast radius collapse from "everything" to "one segment".

Open the Breach Ready demo →See AI asset labeling

FAQ

What's the difference between lateral movement and privilege escalation?

Privilege escalation gains more rights on the same host; lateral movement uses those rights to reach a new host. Real intrusions alternate between them.

Does Zero Trust prevent lateral movement?

Zero Trust is the principle; micro-segmentation is one of the enforcement mechanisms that makes it real for east-west traffic between workloads.

We have EDR, isn't that enough?

EDR is excellent at detection on the host. It does not deny the network flow. Segmentation removes the path; EDR catches what slips through.