Privilege Escalation and Lateral Movement Concepts
From Initial Access to Broader Access
Privilege Escalation
Privilege escalation occurs when an attacker or tester gains more permissions than initially granted. This can happen because of misconfigurations, vulnerable software, weak service permissions, or unsafe automation.
Lateral Movement
Lateral movement is the process of using one compromised system to reach another. Shared credentials, trust relationships, remote management tools, and directory services can make this easier.
Privilege Is a Boundary
Testing should show where permission boundaries break down, not damage systems to prove a point.
Vertical vs Horizontal Movement
Vertical
- Moving to higher privileges on the same system
- Example: user to administrator
- Often caused by local misconfiguration
Horizontal
- Moving to another account or host at similar privilege
- Example: one workstation to another
- Often caused by shared trust or credentials
What does lateral movement refer to?
Lateral movement is about expanding access across the environment.
Correct answer: Moving from one compromised system to another
Name one control that can reduce lateral movement.
Any control that reduces trust propagation is acceptable.
Correct answer: Network segmentation, unique credentials, or strong remote access controls.
Defensive Indicators
What Defenders Watch For
Unusual logons, abnormal service usage, new admin activity, credential reuse patterns, and unexpected connections between systems can indicate movement or privilege misuse.
Which event could indicate lateral movement?
Unexpected internal connectivity can be a strong sign of expansion after compromise.
Correct answer: A workstation begins connecting to many internal servers it never used before
Why are shared credentials risky in enterprise environments?
Shared secrets defeat accountability and increase blast radius.
Correct answer: Because one stolen credential can unlock multiple systems.