Red › Module 7 › Lesson 1
Lateral Named
Lateral movement technique literacy on $LAB_RT — SMB, WMI, RDP, PsExec-class names and detections, not stranger-domain pivot cookbooks.
Visual · t21_lateral_named
Lateral = move between RoE hosts. Name T1021/T1047 patterns. $LAB_RT only. Original Cyberlium.
Opening
Lateral movement is how emulations test segmentation — learn the names and hops blue should alert on, not pivot recipes for AD you never got in writing.
Lateral movement moves an operator from one compromised host to another — Remote Desktop, SMB admin shares, WMI, PsExec-style remote service creation, WinRM, and pass-the-hash concepts as ATT&CK categories. Red-team literacy documents allowed hop paths in YOUR written RoE VLAN and which detections should fire per hop. Cyberlium names lateral classes and defender choke points on $LAB_RT — NOT lateral movement cookbooks against employer production, NOT pivot from lab into dorm /24, NOT 'own the domain' fantasies on stranger forests. Validation = hop diagram within RoE with detection row per edge — minimal proof, mandatory stop at RoE boundary.
1. Lateral classes (literacy)
Remote services: RDP T1021.001, SMB T1021.002, WinRM. Execution: WMI T1047, PsExec-style service create — name, do not export stranger recipes.
Red question: is this hop listed in RoE target list and segmentation test plan?
Command guide
Try these commands — Lateral classes (literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Lateral Movement — https://attack.mitre.org/tactics/TA0008/ (named techniques) MITRE ATT&CK — https://attack.mitre.org/matrices/enterprise/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
Command — copy this
sudo apt install nmap
macOS: Use: netstat
Command — copy this
brew install nmap
Windows: Use: netstat
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t21-rt/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
ss -tulpn 2>/dev/null | head -12
nmap -p 22,135,445,5985,3389 "$LAB_HOST" 2>/dev/null | grep -E 'open|PORT' | head -10Primary tools to practice this lesson: ss, nmap. Reference sites: Lateral Movement (https://attack.mitre.org/tactics/TA0008/); MITRE ATT&CK (https://attack.mitre.org/matrices/enterprise/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender detections
4624/4625 logon types, explicit credentials, Lateral Movement analytic packs, EDR remote service installs, tiered admin model breaks.
Purple: one hop → one detection gap note for blue — improve rules, not hide from them.
3. RoE boundary
Lateral movement only between $LAB_RT hosts in engagement diagram — stop at VLAN border.
No pivot to cloud tenants, classmate projects, or supplier networks outside signed scope.
4. What you ship: lateral literacy card
Three lateral classes + ATT&CK IDs + two detection sources + RoE hop boundary sentence.
5. What you record before the next lesson
Lateral literacy card path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pivot from lab VM into university file server 'because lateral is on the exam.'
Right
Name lateral classes and detections within RoE. Next: Creds Literacy.
Mission: lateral literacy card
1) Define lateral movement in one line. 2) Name three classes with ATT&CK IDs. 3) Write two defender detections. 4) Draw RoE hop boundary rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Which hops are in-scope on my engagement diagram?”
Knowledge Check
APPLY: Lateral movement on Cyberlium:
Multiple choice
Knowledge Check
APPLY: True or False: Pivot outside RoE VLAN is practice.
True or False
Knowledge Check
APPLY: Defenders detect lateral via:
Multiple choice