Lateral Movement

Credential AccessStart here

The attacker objective and tactic of stealing valid credentials, passwords, hashes, tokens, or keys, to authenticate as legitimate users. With stolen credentials, attackers move and act while looking like normal activity.

Discovery

The attacker tactic of exploring a compromised environment to learn about it, enumerating systems, accounts, networks, and defenses, to plan the next moves like lateral movement and privilege escalation.

Credential Dumping

An attacker technique of extracting stored credentials, passwords, hashes, or tickets, from a compromised system, often from memory (like LSASS on Windows) or credential files, to reuse them for lateral movement and escalation.

Foothold

The initial access an attacker establishes on a system or network, the beachhead from which they expand. Gaining a foothold turns an external threat into an internal one and starts the clock on dwell time.

Microsegmentation Principles

Perimeter Model Failure

VPC Flow Log Analysis

VPN Limitations

Local Administrator Password Solution

RDP Lateral Movement Detection