Initial access is rarely the goal of an attack. It is the means. Once an intruder lands somewhere in your environment, the real work begins: spreading sideways, gathering credentials, escalating privileges, and reaching whatever they actually came for. This phase, lateral movement, is where defenders have the most opportunity to detect and stop an incident before it becomes a disaster. Understanding the techniques attackers favour reveals exactly where your detection effort earns the highest return.
Credential Reuse Drives Most Movement
The single biggest enabler of lateral movement is shared credentials. Local administrator passwords reused across hundreds of workstations. Service accounts with the same password set during installation a decade ago. Personal accounts logging into shared systems and leaving cached credentials behind. Each pattern allows an attacker who compromises one host to compromise many more without needing fresh exploits. internal network penetration testing surfaces these patterns systematically by testing credential reuse explicitly across the estate.
Living Off the Land Avoids Detection
Modern attackers prefer built-in tools whenever possible. PowerShell, WMI, PsExec, scheduled tasks, RDP, and PowerShell Remoting all serve their purposes legitimately, which makes their misuse harder to detect. The endpoint agent that flags an unknown binary running from a temp directory may happily ignore wmic.exe doing exactly the same thing. Detection rules that focus on behaviour rather than file hashes catch this pattern. So does scrutinising parent-child process relationships and command-line arguments rather than just executable names.
Expert Commentary
Name: William Fieldhouse
Title: Director of Aardwolf Security Ltd
Comments: When I move laterally during an engagement, I rarely need anything fancy. Standard Windows tooling, valid credentials harvested from one machine, and a willingness to slow down and avoid noise will usually get me where I need to go. The defenders who catch me early are the ones watching for behavioural patterns rather than file signatures.
Pass-the-Hash and Kerberos Abuses
Pass-the-hash, pass-the-ticket, and overpass-the-hash all let an attacker reuse credentials in forms that bypass the need for the original plaintext password. These techniques have been documented for over a decade and remain effective in the vast majority of Windows environments. Defending against them requires Credential Guard, restricted admin mode, careful use of protected accounts, and tier-based access controls that limit which credentials can be used where. Few organisations implement all of these consistently.
Network-Level Movement Patterns
SMB, RPC, and RDP between user workstations are rarely necessary, yet many networks permit them by default. Blocking these protocols laterally between user subnets, while still permitting them from servers and management hosts, breaks several common attack chains without inconveniencing legitimate users. Microsegmentation tools make this easier than it used to be, but the underlying decision is a policy one. Decide which traffic should flow where, then enforce the decision rather than hoping for the best.
Detection That Catches the Quiet Ones
The detections that catch competent attackers focus on the unusual rather than the obvious. Sudden remote access from a workstation that has never initiated such connections before. PowerShell with encoded commands invoked at three in the morning. New scheduled tasks created on multiple hosts within minutes of each other. None of these alerts are perfect on their own, but together they narrow the search dramatically when something does go wrong.
Building Resilience Against Movement
Limit local admin rights, enforce LAPS, segment networks aggressively, monitor authentication patterns, and run periodic adversarial assessments that follow the same playbook real attackers use. The best penetration testing company for this work is one that demonstrates the actual paths through your environment in a way your team can trace and remediate. Generic recommendations from a checklist help with compliance. Specific findings from your network help you stop the next attack.