Lateral Movement

The subject uses a cloud control plane, software deployment system, endpoint-management platform, configuration-management service, or orchestration tool to access, manage, or execute actions on additional organizational systems outside an approved operational requirement.

The subject exploits a vulnerability in a network-accessible service, application, management interface, operating-system component, or hypervisor to obtain unauthorized access or execution capability on an additional organizational system.

This object applies as Preparation where exploitation is used to reach or establish an operating position on a destination system before a later infringement. Where the exploitation itself causes the principal harm, disruption, or unauthorized modification, investigators should also apply the relevant Infringement section.

The subject uses a network-accessible administrative service or operating-system management interface to access resources, transfer content, execute commands, or perform actions on an additional organizational system without establishing an ordinary interactive desktop session.

Methods may include Server Message Block (SMB), Windows administrative shares, Distributed Component Object Model (DCOM), Windows Remote Management (WinRM), or remote Windows Management Instrumentation (WMI).

The subject establishes an interactive command-line, graphical, or cloud-native session with an additional organizational system. The subject may use Remote Desktop Protocol, Secure Shell, Virtual Network Computing, a cloud virtual-machine console, or an equivalent service to operate the destination system.

The subject takes control of an existing authenticated remote service session to operate an additional organizational system under the identity and access context of the session owner. The subject may hijack an active or disconnected RDP session, reuse an SSH agent or socket, or otherwise attach to a pre-existing remote session without completing a new authentication process.