Skip to content
TheCloud.Events

Lateral Movement

Lateral Movement

Section titled “Lateral Movement”

The adversary is trying to move through your environment.

Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.

In cloud environments, lateral movement involves assuming roles across accounts, accessing shared resources, using SSH keys injected via metadata services, or pivoting through VPC peering connections. Adversaries may also move between cloud services (e.g., from a compromised EC2 instance to S3 or RDS) using the permissions of the compromised identity.

View Lateral Movement on MITRE ATT&CK →
Section titled “Events Related to Lateral Movement”

Explore this tactic in the map.