Lateral Movement (TA0008)

---

Often threat actors find that their foothold acquired during initial access is not what they hoped for. In that case, threat actors will likely leverage techniques to move laterally across the target environment. Threat actors may, for example, leverage internal spear phishing, based on discovered information, as a technique to gain access to additional resources or exploit other users. They also might leverage alternate authentication tokens such as password hashes or Kerberos tickets or abuse remote services through valid accounts acquired during the credential access and discovery phases.