# What is Lateral Movement?

> Lateral movement is post-compromise activity in which an adversary uses an existing foothold to access or control additional systems, accounts, services, or environments.

- Canonical URL: https://yellowcube.eu/glossary/lateral-movement/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The objective is to move closer to valuable data or operational targets, expand reach, or establish alternative paths. Movement may cross endpoints, servers, identity systems, cloud resources, network segments, or information technology and operational technology boundaries.

Adversaries may reuse credentials, tokens, administrative shares, remote services, management platforms, trusted relationships, or vulnerabilities. The activity can resemble legitimate administration, especially when valid accounts and native tools are used. Investigation therefore needs identity, endpoint, network, cloud-control-plane, and administrative evidence tied together over time.

### Key points

- **Common enablers:** Excessive privileges, credential reuse, broad reachability, unmanaged trust paths, exposed remote services, and weak separation between administrative tiers can make movement easier.
- **Observable patterns:** New remote sessions, unusual account-to-host combinations, internal service exploitation, credential access followed by remote use, and tools appearing across several systems may warrant correlation.
- **Defensive priorities:** Enforce least privilege and segmentation, protect privileged credentials, restrict and monitor remote administration, centralize relevant logs, and prepare containment actions that preserve evidence and essential services.
- **Important limitation:** A remote login or east–west connection is not proof of lateral movement. Conversely, segmentation can constrain paths but cannot stop movement through allowed services, compromised identities, shared control planes, or overlooked dependencies.

### Related terms

[Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Microsegmentation](<https://yellowcube.eu/glossary/microsegmentation/>) · [Zero trust architecture (ZTA)](<https://yellowcube.eu/glossary/zero-trust-architecture/>) · [Identity-based attack](<https://yellowcube.eu/glossary/identity-based-attack/>) · [Command and control (C2)](<https://yellowcube.eu/glossary/command-and-control/>) · [Persistence](<https://yellowcube.eu/glossary/persistence/>)

### Sources

[MITRE ATT&CK: Lateral Movement (TA0008)](https://attack.mitre.org/tactics/TA0008/) · [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.