Active Directory Lateral Movement

Lateral movement in AD is the loop of find a target → authenticate → execute across machines, escalating toward tier-0 assets. MITRE ATT&CK tracks it under the Lateral Movement tactic (TA0008); the dominant built-in transport is WinRM / PowerShell Remoting — ¹ — because it is legitimate management infrastructure, enabled by default on Windows Server, and blends with admin traffic.

The basic loop

1. Locate: where are privileged sessions and where do you have local admin? PowerView answers both:

   Find-LocalAdminAccess -Verbose     # machines where current user has local admin
   Invoke-UserHunter                  # where Domain Admins are logged in

2. Authenticate: plaintext creds, pass-the-hash, Kerberos tickets (pass-the-ticket), or ACL abuse to reset your way in.
3. Execute: one of the transports below.

WinRM / PowerShell Remoting (T1021.006)

# Interactive session
Enter-PSSession -ComputerName $COMPUTER
 
# Stateful session (reusable, fewer auth events)
$SESSION = New-PSSession -ComputerName $COMPUTER
Enter-PSSession -Session $SESSION
 
# One-shot command execution (fan-out capable)
Invoke-Command -ComputerName $COMPUTER -ScriptBlock { $COMMAND }
 
# Run a LOCAL script on the remote machine
Invoke-Command -FilePath $SCRIPT_PATH -ComputerName $COMPUTER
 
# Run a LOCAL function remotely (arguments append as usual)
Invoke-Command -ScriptBlock ${function:$FUNCTION} -ComputerName $COMPUTER

Invoke-Command against a list of hosts executes in parallel — administrators use it for fleet management, attackers for fleet-wide credential harvesting. WinRM listens on 5985/5986; non-default ports and SOAP-over-HTTP make it distinguishable from web traffic, but in environments that already manage with PowerShell it hides in the noise.

Transport comparison

Transport	MITRE	Notes
WinRM / PSRemoting	T1021.006	Full PowerShell; evil-winrm adds PtH + upload/download from Linux
SMB admin shares + PsExec-style service	T1021.002	Noisy (service install events 7045/4697)
[[wmi-remote-service-execution	WMI]]	T1047
RDP	T1021.001	Interactive; restricted-admin mode enables PtH (xfreerdp)
DCOM	T1021.003	MMC20.Application, ShellWindows — semi-fileless
WinRS	T1021.006	winrs cmd over the same WinRM channel

Credential reuse patterns chain from credential access: mimikatz LSASS dumps feed NTLM pass-the-hash into WinRM/SMB; Kerberos material feeds pass-the-ticket via rubeus or impacket.

Detection

• Event 4624 type 3/10 from unexpected sources; Event 5985/5986 listeners and WinRM 91/168 shell lifecycle events.
• PowerShell script-block logging (4104) catches Invoke-Command payloads even over the wire (they land as script on the target).
• Baseline which admin accounts should fan out — a workstation account touching 50 hosts in a minute is the loudest lateral-movement signature there is.

Sources

• Remote Services: Windows Remote Management
• Lateral Movement
• Windows Remote Management

Related: powerview, ntlm-hashes, evil-winrm, mimikatz, wmi-remote-service-execution, active-directory-weak-permissions, active-directory-trust-pivoting, golden-and-silver-ticket-attacks, rubeus, impacket.

Footnotes

1. Remote Services: Windows Remote Management ↩