Lateral Movement: How Attackers Spread and How to Detect Them

The device an attacker breaks into first is rarely the one they want. Lateral movement is what happens next: the attacker uses that first foothold to steal credentials and hop from machine to machine until they reach domain controllers, file servers or backups. This guide explains how lateral movement works in Active Directory, the techniques behind it, such as pass-the-hash and Kerberoasting, and how to detect and stop it with Microsoft Defender and a 24/7 security operations centre (SOC).

‍

What Is Lateral Movement in Cyber Security?

Lateral movement in cyber security is the stage of an attack in which an intruder who has already got into one system uses it to reach other systems on the same network, usually by stealing and reusing credentials. MITRE ATT&CK, the public knowledge base of attacker behaviour, describes it as the techniques attackers use to enter and control remote systems on a network.

A simple example: a salesperson opens a phishing email and their laptop is compromised. The laptop itself holds little of value. But it gives the attacker a starting point to reach the finance server, and from there a domain controller, which controls every account in the business.

That is why lateral movement matters. It turns one infected device into a company-wide breach, and it is how ransomware spreads across a network far enough to stop a business working.

Attackers often have plenty of time to move. IBM’s Cost of a Data Breach 2026 report found breaches took an average of 247 days to identify and contain. For most of that time, an attacker can quietly work through the network.

Lateral movement vs privilege escalation: lateral movement means moving sideways to other systems, while privilege escalation means gaining higher rights, such as admin access, on a system. Attackers usually alternate between the two, and many escalations start with how small configuration errors lead to privilege escalation.

‍

How Do Hackers Move Laterally Through a Network?

A lateral movement attack usually follows five steps: get a foothold, map the network, steal credentials, use them to sign in to other machines, and repeat until the attacker controls an account with domain-wide rights.

Here is how that plays out at a typical 200-person firm:

1. Foothold. An employee opens a phishing attachment, or the attacker exploits a remote access service left open to the internet. The attacker now controls one ordinary laptop.
2. Reconnaissance. The attacker queries Active Directory to find admin accounts, servers and service accounts. Mapping tools such as BloodHound show the shortest path from that laptop to a domain admin account.
3. Credential theft. Passwords and password hashes are pulled from the laptop’s memory, often with a tool such as Mimikatz. If an IT admin has ever signed in to that laptop, their credentials may be sitting there too.
4. Movement. The attacker uses the stolen credentials to sign in to other machines over normal channels, such as Remote Desktop Protocol (RDP), Server Message Block (SMB) file sharing or remote management tools. Because these are the same tools IT uses every day, the traffic looks routine.
5. Escalation and objective. The attacker repeats steps 3 and 4 on each new machine until reaching a domain controller. From there they can copy data, disable backups or deploy ransomware across the whole network at once.

At no point does the attacker need to break software. Each step reuses access the business has already granted to someone, which is why lateral movement so often goes unnoticed.

This is also why detection has to watch identities and sign-ins, not only files. A security tool looking for malware may see nothing, while a pattern of one account signing in to twenty machines in an hour tells the real story.

‍

What Are the Most Common Lateral Movement Techniques?

The most common lateral movement techniques in Microsoft environments are pass-the-hash, pass-the-ticket, Kerberoasting, credential dumping, NTLM relay and abuse of remote services such as RDP and SMB. Almost all of them reuse stolen credentials rather than exploit software bugs.

A few terms in the table: NTLM (New Technology LAN Manager) is an older Windows sign-in method that still runs alongside Kerberos. LSASS (Local Security Authority Subsystem Service) is the Windows process that holds sign-in credentials in memory. WinRM (Windows Remote Management) lets admins run commands on remote machines.

MITRE ATT&CK keeps a detailed page for each technique, including pass the hash, Kerberoasting and LSASS memory dumping.

For IT teams that want one practical reference, Australia’s cyber agency, CISA, the NSA, Canada’s Cyber Centre, the UK’s NCSC and New Zealand’s NCSC published joint guidance on the 17 most common Active Directory compromise techniques. It explains how each technique works and how to detect and mitigate it, and it is free.

Book a call with CyberQuell to find out which of these lateral movement routes are open in your Active Directory and Microsoft 365 environment.

‍

What Is Kerberoasting?

Kerberoasting is an attack in which any signed-in domain user requests Kerberos service tickets for service accounts, then cracks those tickets offline to reveal the service account passwords. Service accounts often have high privileges and old passwords, which makes them valuable targets.

The attack works because asking for a service ticket is normal. Every time someone opens a file share or a business application, Windows requests one in the background. An attacker using an ordinary employee’s account can request tickets for every service account in the domain, take them away, and try to crack the passwords on their own hardware, where no alarm can see the attempts. The joint guidance on Kerberoasting from CISA and its partners lists it among the most common ways Active Directory is compromised.

How to spot it: a sudden burst of service ticket requests (Windows event 4769) for many service accounts from one user in a short time. Microsoft Defender for Identity raises a Suspected Kerberos SPN exposure alert for this. It often raises a “Security principal reconnaissance (LDAP)” alert first, which Microsoft describes as a common first phase of Kerberoasting.

How to stop it:

• Use group managed service accounts, which have long passwords that Windows rotates automatically.
• Reduce the number of accounts with service principal names (SPNs) to the ones you actually need.
• Use AES encryption for Kerberos instead of the older RC4.
• Where a group managed account is not possible, set a very long, random password on the service account.

‍

What Is Pass-the-Hash, and How Do Mimikatz and NTLM Fit In?

Pass-the-hash is when an attacker signs in to other machines using a stolen password hash instead of the real password. Tools such as Mimikatz pull those hashes from Windows memory, and the older NTLM authentication protocol accepts them, which is why reducing NTLM is a long-term fix.

The three pieces fit together simply. Mimikatz, or any similar credential dumping tool, gets the hash. NTLM lets the hash be used to sign in without ever knowing the password. And if every laptop shares the same local admin password, one stolen hash opens all of them.

Microsoft’s NTLM direction. Microsoft has already removed NTLMv1 from Windows 11 24H2 and Windows Server 2025. Since the October 2026 security update, those versions also block NTLMv1-derived single sign-on credentials by default on devices without Credential Guard. Microsoft plans to turn NTLM off by default in the next major Windows Server release, with admins able to switch it back on by policy. Start auditing where NTLM is still used now, so nothing breaks when the default changes.

Protecting hashes in memory. LSA protection stops other programs reading Windows credential memory. It works on all supported Windows editions and is on by default on new, domain-joined Windows 11 22H2 or later installs that meet the hardware requirements. Credential Guard goes further by isolating hashes completely, but it needs Windows Enterprise or Education licences, so most Microsoft 365 Business Premium devices rely on LSA protection instead. Both can break older plug-ins or sign-in methods, so test before rolling out.

Detection. Microsoft Defender for Identity raises a “Suspected identity theft (pass-the-hash)” alert when a hash is reused from another machine. Microsoft Defender for Endpoint alerts when a process tries to read LSASS memory, which is usually the step before.

‍

How Do You Detect Lateral Movement?

You detect lateral movement by watching how accounts sign in, not just which files run: one account signing in to many machines, admin tools launched from ordinary laptops, unusual Kerberos or NTLM activity, and access to Windows credential memory are the strongest signals.

Warning signs to watch for:

• One user or service account signing in to many devices in a short time
• Remote Desktop, PsExec or remote management tools launched from a workstation that normally never uses them
• New services or scheduled tasks created on a machine from somewhere else
• Bursts of Kerberos service ticket requests, or NTLM sign-ins where Kerberos is expected
• Processes reading LSASS memory
• Admin accounts used outside working hours or from devices they have never used before

Which Microsoft Tools Detect Lateral Movement?

Microsoft Security Exposure Management also maps attack paths to critical assets, including hybrid paths that cross from on-premises into the cloud. That shows where an attacker could move before they try.

The tools only help if someone acts on what they raise. With managed XDR, analysts work the Defender alerts around the clock. Microsoft Sentinel monitoring adds the firewall, server and third-party logs that Defender cannot see.

Which Lateral Movement Alerts Should You Act On First?

Alerts on domain controllers and privileged accounts come first, because those are the assets lateral movement is aiming for. Ranking alerts by asset criticality means a strange sign-in to a domain controller is never stuck behind a noisy test server.

Speed is what turns detection into protection. In one CyberQuell partner’s environment, a ransomware precursor, a Cobalt Strike beacon picked up by Defender for Endpoint, was contained in 11 minutes. Proactive threat hunting adds a second layer, finding quiet movement that never triggers an alert.

‍

How Do You Prevent Lateral Movement?

You prevent lateral movement by making stolen credentials harder to steal and less useful: unique local admin passwords, separate admin accounts used only from admin devices, LSA protection or Credential Guard, safer service accounts, less NTLM, and network rules that stop workstations talking to each other.

1. Give every device a unique local admin password with Windows LAPS. Windows LAPS is built into Windows and free. It rotates each device’s local admin password, which Microsoft says protects against pass-the-hash and lateral movement, because one stolen password no longer opens every machine.
2. Use separate admin accounts and admin-only devices. Domain admins should never sign in to ordinary laptops or read email with their admin account, so their credentials are never left behind where an attacker lands.
3. Protect credential memory. Turn on LSA protection on every device. Add Credential Guard where you hold Windows Enterprise or Education licences.
4. Make service accounts safer. Use group managed service accounts and AES encryption to defeat Kerberoasting.
5. Put privileged accounts in the Protected Users group. This blocks NTLM and older Kerberos encryption for those accounts.
6. Reduce and audit NTLM. Find what still depends on it before Microsoft turns it off by default.
7. Block workstation-to-workstation traffic. Host firewalls and network segmentation stop RDP and SMB connections between ordinary laptops, which have no reason to talk to each other.
8. Use phishing-resistant MFA and just-in-time admin rights for cloud admins. Admin rights that only exist when needed cannot be stolen the rest of the time.
9. Monitor 24/7 with fast containment. Prevention reduces the routes; monitoring catches the attacker on the ones that remain.

No single control covers every technique. Windows LAPS and separate admin accounts close the most routes for the least effort, so most teams should start there.

‍

What Should You Do If You Detect Lateral Movement?

If you detect lateral movement, contain first and investigate second: isolate affected devices, disable or reset the accounts being used, revoke their sessions, and check domain controllers before assuming the attack is over.

1. Isolate affected devices. Use device isolation in Microsoft Defender for Endpoint to cut infected machines off the network while keeping them available for investigation.
2. Disable or reset compromised accounts and revoke their sessions. If a domain admin account or a domain controller was touched, plan a reset of the KRBTGT account, the account that signs every Kerberos ticket in the domain. Microsoft Defender for Identity recommends resetting the KRBTGT password twice so forged tickets stop working.
3. Check domain controllers. Look for new admin accounts, unexpected replication requests and new services.
4. Find out how far it spread. Use Defender XDR incident timelines and Microsoft Sentinel to trace which accounts and machines were touched.
5. Remove persistence. Delete the scheduled tasks, services, new accounts and remote access tools the attacker left behind.
6. Fix the route before reconnecting. Close the gap that allowed the movement, such as a shared local admin password or an exposed admin account, before bringing systems back online.
7. Follow your plan and keep evidence. Work through your incident response plan and record every action, because insurers, regulators and investigators will ask for it.

Speed matters more than perfection in the first hour. CyberQuell’s playbook is to “isolate the affected asset, investigate the blast radius, contain lateral movement, and remediate”. Every critical and high-severity alert is under investigation within 15 minutes through 24/7 SOC monitoring and response.

‍

How Does Lateral Movement Work in Hybrid and UAE Environments?

In hybrid environments, attackers can move from on-premises Active Directory into Microsoft 365 and Azure through synced accounts, so on-premises and cloud identity monitoring have to work together.

Hybrid Active Directory and Microsoft 365

Two weak points connect the two worlds. A privileged on-premises account that is synced to the cloud gives an attacker a foothold in both, and the Microsoft Entra Connect sync server holds the keys to the directory, so compromising it can open a path straight into Microsoft Entra ID. Our guide to hybrid identity risks covers how to scope the sync and lock that server down.

Once an attacker reaches the cloud side, the techniques change to password spraying, token theft and risky sign-ins, which identity threat detection and response for Microsoft 365 is built to catch.

UAE Organisations

UAE businesses in Dubai and Abu Dhabi face the same lateral movement techniques, and the same Microsoft controls stop them. For organisations working towards the UAE Information Assurance Standards set by NESA (the former National Electronic Security Authority), CyberQuell’s UAE security assessments review access control, including privileged access, MFA and legacy authentication, alongside log management and monitoring. Those are the areas where lateral movement routes usually show up.

For ongoing coverage, CyberQuell’s managed security services in the UAE monitor for compromised credentials, privilege escalation and lateral movement through Microsoft Entra ID and Defender for Identity.

‍

Final Thoughts

The first device an attacker breaks into is rarely the one they want, so the real defence is making sure that first foothold leads nowhere. Remove shared local admin passwords and keep admin accounts off ordinary laptops, so stolen credentials stop opening doors. Then watch sign-ins around the clock, so any movement that remains is caught in minutes, not months. Detection only protects the business when containment follows straight after, and that combination is what turns a single infected laptop into a contained incident rather than a company-wide breach.

Book a call with CyberQuell to detect and contain lateral movement across Active Directory, endpoints and Microsoft 365 with managed XDR and 24/7 SOC monitoring.