Lateral Movement

Once you have credentials or a shell on one host, the real game begins: moving through the network without getting caught. Lateral movement in Active Directory is where most engagements are won or lost. This is the full playbook. Every technique. The tools, the commands, the detection notes, and the OPSEC considerations that separate a successful engagement from a blocked one. What Is Lateral Movement in AD? Lateral movement is the process of using access on one system to gain access to others. In an Active Directory environment, this is especially powerful because credentials, tickets, and tokens are often reusable across the domain. ...

Active Directory credential attacks come in two flavors that confuse people constantly: Pass-the-Hash (PtH) and Pass-the-Ticket (PtT). Both let you authenticate as another user without knowing their plaintext password. But they work on completely different protocols, hit different defenses, and fail in different ways. This guide covers how each attack actually works under the hood, when to reach for one vs the other, how defenders detect them, and how red teamers stay ahead of detection. ...

CrackMapExec is dead. Long live NetExec. If you’ve been in offensive security for more than a few years, CrackMapExec (CME) was probably one of the first tools you learned. It became the go-to for Active Directory enumeration, credential testing, and lateral movement — packed into a single framework with clean output and a protocol-agnostic design. In 2023, the original author archived the project. The community forked it and kept building under a new name: NetExec (nxc). Same DNA, actively maintained, and compatible with everything CME could do. ...

Azure is the second-largest cloud platform on the planet and the dominant choice in enterprise environments. Microsoft’s deep integration with Active Directory, Office 365, and enterprise tooling means Azure is everywhere corporate red teams operate. If you’re doing internal red team work or enterprise pentesting in 2026, Azure is unavoidable. This guide covers the full attack chain — from initial recon through credential theft, RBAC abuse, lateral movement, and persistence — with real commands and the tools that actually work. ...