# What is lateral movement in cybersecurity?

Lateral movement is how an attacker spreads from the first compromised machine to others, typically with stolen credentials over remote services such as SMB, RDP, SSH or WinRM. MITRE ATT&CK lists it as tactic TA0008; Remote Services is technique T1021.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-lateral-movement-in-cybersecurity

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [How do you detect C2 beaconing?](https://netsenx.com/en/faq/how-do-you-detect-c2-beaconing)
- [Can you detect lateral movement in encrypted traffic?](https://netsenx.com/en/faq/can-you-detect-lateral-movement-in-encrypted-traffic)
- [Which MITRE ATT&CK techniques can network detection see?](https://netsenx.com/en/faq/which-mitre-att-ck-techniques-can-network-detection-see)
- [What is C2 beaconing?](https://netsenx.com/en/faq/what-is-c2-beaconing)
- [What is data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-data-exfiltration)