TA0008
Lateral Movement
Description
The adversary is trying to move through your environment. Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.
Following through on their primary objective often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.
Techniques (9)
T1021
Remote Services
T1072
Software Deployment Tools
T1080
Taint Shared Content
T1091
Replication Through Removable Media
T1210
Exploitation of Remote Services
T1534
Internal Spearphishing
T1550
Use Alternate Authentication Material
T1563
Remote Service Session Hijacking
T1570
Lateral Tool Transfer