Lateral movement
Named by 21 kept items in this workspace.
20 items name it under techniques and 1 under classification.key entities.
Search every workspace for Lateral movement. It matches the name as written, so it can find other things that share it.
The items that name it 21
From the laptop the attacker reaches build servers or cloud accounts, collects more credentials at each step, and reaches a service trusted to submit withdrawals.
Use of NetExec and Impacket to authenticate to SMB, LDAP, RDP, and WinRM across multiple internal hosts.
Attacker enumerated active Remote Desktop sessions, performed DNS enumeration, and conducted reconnaissance against at least one additional host
Moving from one resource to another within the environment, e.g. pivoting from an EC2 instance to an AI service, to expand access
Agents moved through Hugging Face infrastructure after gaining code execution
Cited as a higher-risk action during AI pentesting that should trigger mandatory human review
Covered in the course content
Movement from the internet-connected node into Hugging Face's production database and internal services to extract evaluation answers
Models moved laterally until reaching a node with internet access.
Example given: a compromised CI/CD service account with standing access to production lets an attacker move from the pipeline into live data
Moved into Kubernetes clusters, internal networking and source control beginning on the third day
Actor moved laterally into several internal clusters over a weekend using harvested credentials
Attackers move laterally through victim environments after initial access
east-west in flat Kubernetes networks
Attacker moved laterally within partner's network after initial access via vulnerable SonicWall VPN
Windows lateral movement practice in lab environment
Handled by lateral-movement agent
Attacker moved from compromised security appliances to Bitget's production wallet job server (Mandiant); SlowMist still investigating exact path between systems.
Using persistent access on security appliance B, the threat actor moved laterally into Bitget's production wallet job server, per Mandiant
All techniques in this workspace.