What is lateral movement in cybersecurity? Definition & examples
Lateral movement is the set of techniques attackers use to pivot from an initially compromised system to other hosts and accounts across a network, expanding access toward their objective.
Once an attacker has a foothold, a single machine is rarely the goal. Lateral movement is how they spread, hopping from host to host and account to account, until they reach the data, servers, or domain controllers they actually want.
How does lateral movement work?
Attackers typically combine stolen credentials with legitimate remote-access protocols so their activity blends in:
- Pass-the-hash and pass-the-ticket reuse stolen authentication material.
- Remote execution via PsExec, WMI, SSH, or RDP moves to new hosts.
- Abuse of Active Directory trust relationships and Kerberos.
Operators map the environment with tools such as BloodHound to find the shortest path to high-value targets, frequently pairing lateral movement with privilege escalation.
Lateral movement in the attack lifecycle
It sits in the middle of the kill chain, after initial access and before final actions on objectives, and it is a core part of red teaming. The MITRE ATT&CK framework dedicates an entire tactic to it.
How is lateral movement detected?
Defenders watch for unusual authentication patterns, new remote sessions between workstations, and anomalous use of admin tools, which is where network security monitoring and EDR matter.
How to practice lateral movement hands-on
On Purple Edge the red-team learning hub provides multi-host cloud ranges where you can compromise one machine and pivot across a realistic network, learning credential reuse and pivoting safely.
Practice this in the Learn Red Teaming and Adversary Emulation learning path.
Put this into practice
Spin up real Kali, Ubuntu and Windows labs in your browser and learn by doing. Guided, hands-on, no setup.
Last updated: 2026-06-16