Lateral movement

Concept

Lateral movement describes an attacker moving from one system to another inside a network after gaining an initial foothold.

Title graphic: Lateral movement (Concept)

Type	Concept

Key points about Lateral movement

Least privilege and segregation of accounts and systems prevent lateral movement. · AD Tiering and Privileged Access with Viktor…
Microsoft Defender for Identity detects suspicious identity activity such as stolen credentials, privilege abuse and lateral movement. · Microsoft Defender for Identity - Simply…
A typical path runs from one phished user through lateral movement, to privilege escalation with DCSync or Golden Ticket, to domain-wide control. · Harden Azure AD Connect Against Hybrid…
Defender for Identity detects lateral movement, abnormal resource access, Kerberoasting or NTLM abuse and privilege hunting. · Conditional Access with Defender for Identity…

Episodes about Lateral movement

AD Tiering and Privileged Access with Viktor Hedberg…

2026-05-23 · Video on YouTube

In this episode of the m365.fm podcast, host Mirko Peters speaks with cybersecurity expert Viktor Hedberg about the importance of securing enterprise environments through Active Directory (AD) tiering and privileged access management. The discussion explores…

Global Secure Access - Simply Explained

2026-08-06 · Video on YouTube

VPNs were built for a world where everyone worked in one office and apps lived in one data center. This knowledge nugget helps IT and security teams understand Microsoft Entra Global Secure Access in plain English, showing how Private Access and Internet…

How Ransomware Moves Through Active Directory

2025-12-21 · Video on YouTube

Security drift in Active Directory and Azure AD isn’t a single bug — it’s the slow, invisible decay of identity, permissions, and governance posture that happens when environments aren’t routinely managed and remediated. Over time, this drift increases risk…

Microsoft Defender for Identity - Simply Explained

2026-07-22 · Video on YouTube

Attackers no longer break in - they log in with stolen credentials, and traditional security tools never notice. This episode explains how Microsoft Defender for Identity watches your on-premises Active Directory with sensors and behavioral analytics.…

Harden Azure AD Connect Against Hybrid Identity Breaches

2025-11-03 · Video on YouTube

Active Directory (AD) is the single crown-jewel system: compromise it and an attacker can own identities, files, mail, GPOs—everything. Breaches rarely hinge on zero-days; they accelerate through identity abuse: one phished user → lateral movement…

Conditional Access with Defender for Identity Signals

2025-08-05 · Video on YouTube

Your best Microsoft 365 security signal isn’t the login—it’s what the identity does next. Wire Conditional Access (the gatekeeper) to listen to Defender for Identity (the watcher), and you’ll auto-raise friction when behavior turns risky—shrinking dwell time…

Timeline of episodes about Lateral movement

Articles about Lateral movement (2)

Stop Lateral Movement in its Tracks with Smart Access Tiering
2026-08-13 · Mirko Peters
Welcome back to the podcast companion blog, where we dive deeper into the architectural blueprints, technical strategies, and real-world implementations that keep c…
Identity Security and Zero Trust Guide
2026-05-04 · Mirko Peters
Unlock robust security with our Zero Trust guide. Understand principles, best practices, and access control for this essential security model and its adoption.

Frequently asked questions

What is lateral movement?

Lateral movement means attackers moving through a network using compromised accounts. Attackers commonly target privileged accounts for this, which is why tiering and privileged access management matter. · From the episode: AD Tiering and Privileged Access with Viktor…

What does Zero Trust mean here?

It does not assume that anyone on the company network is trustworthy. Every request is continuously validated, which helps reduce lateral movement. · From the episode: Global Secure Access - Simply Explained

What is Microsoft Defender for Identity?

Microsoft Defender for Identity is a security service that helps teams detect and investigate attacks aimed at credentials, privileges and lateral movement. It focuses on identity activity rather than files or network perimeters. · From the episode: Microsoft Defender for Identity - Simply…

How do attackers take over Active Directory?

The episode describes a path from one phished user to lateral movement using pass-the-hash or ticket reuse, then privilege escalation with DCSync or Golden Ticket, ending in domain-wide control. · From the episode: Harden Azure AD Connect Against Hybrid…

What is the difference between Conditional Access and Defender for Identity?

Conditional Access is the bouncer, deciding who gets in based on user, location, device posture and sign-in risk. Defender for Identity is the watcher, spotting behavior after sign-in such as lateral movement. · From the episode: Conditional Access with Defender for Identity…

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Profile: attack.mitre.org/tactics/TA0008
Feed for this topic (RSS): entity/lateral-movement/feed.xml
M365.FM episodes on this topic: 6
Articles on this topic: 2

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-03