Pivoting and lateral movement

A foothold is not a breach

When an attacker first lands on a machine — a vulnerable web server, a phished laptop, an exposed Jenkins box — they almost never have what they actually came for. The crown jewels (the database, the domain controller, the secrets vault) live elsewhere, usually on a different network segment the initial host can reach but the internet cannot. The entire mid-game of a real intrusion is getting from the foothold to the target. MITRE ATT&CK calls this whole tactic Lateral Movement (TA0008), and it is where a contained incident becomes a company-ending one.

There are two distinct moves under that umbrella, and conflating them is the most common junior mistake:

• Pivoting is a network move. The compromised host becomes a relay: the attacker tunnels traffic through it to reach systems they can’t route to directly. Their tools still run on their own machine; the popped box just forwards packets. This is how an attacker on the public web server reaches the private database subnet behind it.
• Lateral movement is an identity move. The attacker uses credentials, tokens, keys, or trust relationships harvested from the foothold to authenticate to other hosts as a legitimate user. No exploit fires — they log in. This is how one set of cached admin credentials becomes the entire fleet.

In practice they interleave: you pivot to gain network reach to a host, then move laterally by authenticating to it with stolen identity. Hold that distinction, because the defenses are different — one is network architecture, the other is identity discipline.

Pivoting: turning a host into a relay

The defining property of a pivot is that it costs the attacker no new credential — it’s pure reachability. Say the foothold is a DMZ web server that, by design, can talk to an internal app subnet (it has to; it serves the app). The attacker can’t route to that subnet from the internet, but the web server can. So they turn the web server into a proxy: a SOCKS tunnel, an SSH port-forward, or a reverse connection back to their infrastructure. Now every tool on the attacker’s laptop — scanners, clients, exploit frameworks — reaches the internal subnet as if the attacker were sitting on the DMZ box, because, network-wise, they are.

This is why flat networks are catastrophic. If every host can reach every other host on a useful port, then a single foothold gives the attacker line-of-sight to everything; pivoting is trivial because there’s nothing to pivot around. The defensive property that breaks this is segmentation: split the network into zones with explicit, least-privilege allow-rules between them, so the DMZ web server can reach only the one app port it genuinely needs and nothing else. Now a pivot through it buys the attacker reach to one tightly-scoped service instead of the whole estate — the relay still works, but it relays into a wall.

Lateral movement: reusing identity, not exploits

The unsettling thing about real lateral movement is how little of it looks like hacking. Once an attacker has admin on one Windows host, they can often read credential material straight out of memory or the local secrets store, then reuse it to authenticate elsewhere — and the most-feared form is pass-the-hash. In Windows NTLM authentication, the server never needs the user’s plaintext password: it accepts a cryptographic hash of it as proof of identity. So an attacker who steals the NTLM hash of a privileged account from one machine can present that hash directly to another machine and authenticate as that user — without ever cracking the password. The hash is the credential. Crack nothing, phish nothing; just replay the secret.

This is why credential reuse is the multiplier that turns one host into a thousand. The classic disaster is a single local-administrator password shared across every workstation in the fleet: pop one machine, harvest that hash, and you can pass-the-hash into every other machine that shares it. The same shape appears everywhere outside Windows — a long-lived cloud access key on a build server, an SSH private key with no passphrase, a service-account token mounted into a pod that’s valid cluster-wide. The pattern is identical: a secret with broad scope and long life, cached somewhere an attacker who owns the host can read it.

The defensive property is identity hygiene, and it attacks the reuse directly: unique per-host local credentials (so a stolen hash unlocks exactly one box — Microsoft’s LAPS exists for exactly this), short-lived and tightly-scoped tokens instead of long-lived broad keys, no privileged credentials cached on low-trust machines, and phishing-resistant MFA so a replayed secret alone isn’t enough to authenticate. Pair that with segmentation and the attacker’s two moves are both starved: nowhere useful to pivot to, and no reusable identity to move with.

How a defender reasons about the whole class

The senior move is to stop defending the perimeter as if landing on one host were the loss, and instead assume breach: take it as given that some host will be popped, and ask “what does that one foothold actually let them reach and become?” That question has exactly two answers to attack. Segmentation bounds the reach — least-privilege network paths so a relay relays into a wall, not the whole estate. Identity hygiene bounds the become — unique, short-lived, narrowly-scoped credentials so harvested identity unlocks one box, not the fleet. Detection is the third leg: lateral movement is unusually visible if you’re watching for it — a workstation suddenly authenticating to twenty hosts, or an admin hash used from an IP it’s never logged in from, is a loud signal — so log authentication centrally and alert on the impossible-shaped login. The pentester’s whole pivot-and-move chain is just the inverse of these three controls; every link is a defense you either built or didn’t.