Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Lateral Movement
Platforms: Windows, Linux, macOS, IaaS, Network Devices, ESXi
Relationship: conceptual coverage
Open the official ATT&CK object ↗Tactics: Lateral Movement
Platforms: Windows, Linux, Network Devices, ESXi
Relationship: conceptual coverage
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related defensive techniques
Inferred and experimental: These relationships are generated from D3FEND graph paths. They are hypotheses for analysis, not proof of prevention, detection, or control effectiveness.
Showing 30 of 36 inferred defensive relationships.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
What it means
Attackers often move after initial access to reach higher-value data, management systems, identity infrastructure, or broader control. The activity may use legitimate protocols and tools.
Why it matters
Segmentation, privileged-access controls, endpoint visibility, and authentication monitoring can reduce both opportunity and dwell time.
Practical focus
- Restrict remote administration paths
- Separate privileged accounts and workstations
- Monitor unusual peer-to-peer and administrative connections
- Limit reused local credentials and standing privileges
Common mistakes
- Looking only for malicious binaries
- Allowing broad east-west connectivity
- Using the same administrative credentials across many systems
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: