How to Use MITRE ATT&CK for Lateral Movement Investigation

Possible lateral movement means a user, process, or adversary may have moved from one system, account, or service to another. A single remote connection is not automatically proof of lateral movement, especially in an environment where administration and automation are normal.

Short answer: investigate lateral movement by building a sequence of source and destination activity, identifying the access method, mapping only supported ATT&CK techniques, checking identity and asset context, and validating whether the second system was actually accessed or changed.

MITRE ATT&CK places lateral movement under the Enterprise Lateral Movement tactic. The mapping is a way to organise evidence and questions. It does not replace scope analysis, containment, or severity decisions.

Start with the movement evidence

Capture the sequence before choosing a technique:

• Source host, account, process, and network location.
• Destination host, account, service, and privilege.
• Authentication method and result.
• Remote service, protocol, management tool, or shared resource.
• Start and end timestamps.
• Commands, processes, files, sessions, or changes on the destination.
• Whether the activity was expected for the user, service, or administrator.
• Related alerts before and after the connection.

The most useful question is not “Which technique is this?” It is “What evidence shows that activity moved from one security context to another, and what happened there?”

Candidate ATT&CK techniques

Consider a technique only when the evidence supports the behavior.

Remote Services: T1021

Remote Services may be relevant when remote access uses a service such as RDP, SMB, SSH, WinRM, or another supported sub-technique. Record the actual service and source evidence rather than using the parent technique as a generic label.

Valid Accounts: T1078

Valid Accounts may be relevant when legitimate credentials were used in a way that may represent adversary activity. A normal administrator login or service connection is not enough by itself. Review privilege, timing, source, destination, and surrounding behavior.

Exploitation of Remote Services: T1210

Consider Exploitation of Remote Services only when evidence supports exploitation of a remote service. A successful remote login does not automatically demonstrate exploitation.

Use Alternate Authentication Material: T1550

Evidence of pass-the-hash, pass-the-ticket, or another supported alternate authentication method may support Use Alternate Authentication Material. Preserve the identity-provider, endpoint, and authentication records needed to test the hypothesis.

Separate access from movement

An investigation may involve several related behaviors:

1. Credentials were obtained or exposed.
2. The credentials were used against a source or destination.
3. A remote service accepted the connection.
4. The destination was queried, changed, or used for another action.

Do not collapse all four into one technique. Credential access, valid-account use, remote services, and follow-on activity answer different questions and may need different containment actions.

Use an evidence-to-question table

Record the answer, source, confidence, and next action. A technique label without the related question is not enough to guide the investigation.

Build a lateral movement timeline

Order the activity across source and destination systems:

• Initial suspicious event or credential change.
• First source-side preparation or discovery.
• Authentication attempt and result.
• Remote service connection.
• Destination process, file, account, or configuration activity.
• Additional connections or spread.
• Containment action and its effect.
• Validation checks and remaining uncertainty.

This helps the team distinguish an isolated administrative connection from a chain of related behavior. It also identifies which logs should be preserved before retention windows expire.

Decide what the mapping changes

The mapping should change an investigation or response decision. It may lead the team to:

• Search for the same source and destination pattern elsewhere.
• Review the account’s privileges and recent changes.
• Isolate a host or revoke a session after assessing impact.
• Preserve endpoint, identity, and network evidence.
• Check whether the destination was used to access data or create persistence.
• Update a detection rule or response playbook after validation.

Do not treat the mapping as a mandatory checkbox for every remote connection. For a wider explanation, see how MITRE ATT&CK mapping improves incident response quality.

Where IncidentAI fits

IncidentAI can help structure incident records, timelines, evidence, ownership, and ATT&CK context where relevant. It can assist with candidate mappings and next-step organisation, but responders still need to verify the behavior, determine scope, approve containment, and validate the result.

For the next response decision, see how MITRE ATT&CK helps teams choose better containment actions. For the final outcome check, see how MITRE ATT&CK mapping supports incident validation.

Frequently asked questions

What is lateral movement in an incident investigation?

It is possible movement from one system, account, or security context to another after an initial event. The team should confirm the sequence and destination activity rather than infer it from one remote connection.

Which ATT&CK techniques are common for lateral movement?

Remote Services, Valid Accounts, Exploitation of Remote Services, and Use Alternate Authentication Material may be relevant, depending on the evidence and the exact behavior.

Does a successful remote login prove lateral movement?

No. The team should check whether the connection was expected, which service was used, what happened on the destination, and whether related activity shows a broader sequence.

How should lateral movement mapping affect containment?

It can help identify the access path, affected scope, and evidence to preserve. The authorised responder still chooses a proportionate action and validates whether it reduced the risk.

Should every remote connection be mapped to ATT&CK?

No. Map the behavior when it improves the investigation, response decision, handoff, or post-incident learning. Avoid speculative labels and checkbox-driven mapping.

Sources

• MITRE ATT&CK Lateral Movement
• MITRE ATT&CK Remote Services
• MITRE ATT&CK Valid Accounts
• MITRE ATT&CK Exploitation of Remote Services