Windows:
Lateral Movement
Hash, ticket, SMB, WMI, WinRM, RDP, and token lateral moves
Pass-the-Hash and Pass-the-Ticket
Covers PTH and PTT attack techniques exploiting NTLM hashes and Kerberos tickets to authenticate laterally across Windows environments without plaintext credentials.
PsExec and SMB Lateral Movement
Covers PsExec-based lateral movement over SMB, including remote execution techniques, admin share abuse, and detection of suspicious PSEXESVC artifacts.
RDP Hijacking and Credential Reuse
Exploits RDP sessions and reused credentials to move laterally across Windows environments, hijacking active sessions without requiring plaintext passwords.
WinRM and PowerShell Remoting Lateral Movement
Exploiting WinRM and PowerShell Remoting to move laterally across Windows environments using Enter-PSSession, Invoke-Command, and evil-winrm.
WMI Remote Execution for Lateral Movement
Leverages WMI to execute commands on remote Windows hosts for lateral movement, covering WMIC, PowerShell invoke methods, and evading common detections.
Windows lateral movement is about moving from one compromised host to the next using legitimate administration tools and protocols. PsExec, WMI (wmiexec), DCOM, WinRM, RDP, and SMB-based execution each leave different forensic traces and work in different network configurations.
Credential reuse is the core of most lateral movement. Pass-the-hash with Impacket or Mimikatz, pass-the-ticket with Kerberos TGTs, and overpass-the-hash let you authenticate without knowing the plaintext password. Named pipe abuse and service creation through SCM provide execution when interactive logon is restricted.
The subpages cover each technique with tool-specific syntax (Impacket, CrackMapExec, Evil-WinRM), explain which authentication types work with which methods, and detail the event log footprint of each approach so you can choose the quietest path for the environment.