Attacks and malware
What is Lateral movement?
An attacker moving from the first machine they compromised to other systems inside the same network, usually toward valuable data or admin access.
Lateral movement is how an attacker spreads from the first compromised machine to other systems in the network. They typically use stolen credentials with legitimate tools: remote desktop, SMB file shares, PsExec, WMI, PowerShell remoting or SSH.
Because these are normal administration methods, lateral movement is hard to spot from any single event. Detection relies on unusual patterns, such as a workstation logging in to many servers or an account used from hosts where it never appears.