Tactic.View on attack.mitre.org
The adversary is trying to move through your environment.
Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.
| ID | Name | Sub-techniques | Examples |
|---|---|---|---|
| T1021 | Remote Services | 8 | 191 |
| T1072 | Software Deployment Tools | 0 | 10 |
| T1080 | Taint Shared Content | 0 | 12 |
| T1091 | Replication Through Removable Media | 0 | 28 |
| T1210 | Exploitation of Remote Services | 0 | 25 |
| T1534 | Internal Spearphishing | 0 | 8 |
| T1550 | Use Alternate Authentication Material | 4 | 43 |
| T1563 | Remote Service Session Hijacking | 2 | 3 |
| T1570 | Lateral Tool Transfer | 0 | 55 |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
