Cyber Wiki Learning Path
MITRE ATT&CK®: Lateral Movement
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Lateral Movement objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
23 connected entries
Application Access Token (T1550.001)
Application Access Token (T1550.001) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedCloud Services (T1021.007)
Cloud Services (T1021.007) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedDirect Cloud VM Connections (T1021.008)
Direct Cloud VM Connections (T1021.008) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedDistributed Component Object Model (T1021.003)
Distributed Component Object Model (T1021.003) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK technique profile · IntermediateExploitation of Remote Services (T1210)
An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.
ATT&CK technique profile · IntermediateInternal Spearphishing (T1534)
Internal Spearphishing (T1534) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateLateral Tool Transfer (T1570)
An adversary copies tools or files between systems inside the target environment to support continued movement and execution.
ATT&CK sub-technique profile · AdvancedPass the Hash (T1550.002)
Pass the Hash (T1550.002) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedPass the Ticket (T1550.003)
Pass the Ticket (T1550.003) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedRDP Hijacking (T1563.002)
RDP Hijacking (T1563.002) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedRemote Desktop Protocol (T1021.001)
Remote Desktop Protocol (T1021.001) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK technique profile · IntermediateRemote Service Session Hijacking (T1563)
Remote Service Session Hijacking (T1563) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateRemote Services (T1021)
An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.
ATT&CK technique profile · IntermediateReplication Through Removable Media (T1091)
Replication Through Removable Media (T1091) is an Enterprise ATT&CK technique associated with Lateral Movement, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedSMB/Windows Admin Shares (T1021.002)
SMB/Windows Admin Shares (T1021.002) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedSSH (T1021.004)
SSH (T1021.004) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedSSH Hijacking (T1563.001)
SSH Hijacking (T1563.001) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK technique profile · IntermediateSoftware Deployment Tools (T1072)
Software Deployment Tools (T1072) is an Enterprise ATT&CK technique associated with Execution, Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateTaint Shared Content (T1080)
Taint Shared Content (T1080) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateUse Alternate Authentication Material (T1550)
Use Alternate Authentication Material (T1550) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedVNC (T1021.005)
VNC (T1021.005) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedWeb Session Cookie (T1550.004)
Web Session Cookie (T1550.004) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
ATT&CK sub-technique profile · AdvancedWindows Remote Management (T1021.006)
Windows Remote Management (T1021.006) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.