Home TacticsLateral Move

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0008

Lateral Movement

The adversary is trying to move through your environment. Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.

Associated Techniques(9)

T1210

Exploitation of Remote Services

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

T1534

Internal Spearphishing

Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization.

T1570

Lateral Tool Transfer

Adversaries may transfer tools or other files between systems in a compromised environment.

T1563

Remote Service Session Hijacking

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.

2 sub-techniques

T1021

Remote Services

Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections.

8 sub-techniques

T1091

Replication Through Removable Media

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media.

T1072

Software Deployment Tools

Adversaries may gain access to and use third-party software suites installed within an enterprise network to move laterally.

T1080

Taint Shared Content

Adversaries may deliver payloads to remote systems by adding content to shared storage locations.

T1550

Use Alternate Authentication Material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens.

4 sub-techniques

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact