 human being who is operating tools within the organization's network, or a tool with “learning” capabilities, learns information about the environment it is operating in, such as network topology, network devices and organization structure, learns “where can I go from my current location” and “how can I move from my current location to another location (privilege required)”, learns implemented security solutions, learns applications that he can leverage, and then operates in accordance with that data.
An advanced attacker may use different attack techniques to enter a corporate network and to move laterally within the network in order to obtain his resource goals. The advanced attacker may begin with a workstation, server or any other network entity to start his lateral movement. He uses different methods to enter the network, including inter alia social engineering, existing exploits and vulnerabilities, and a Trojan horse or any other malware allowing him to control a first node or nodes.
Once an attacker has taken control of a first node in a corporate network, he uses different advanced attack techniques for orientation and propagation and discovery of additional ways to reach other network nodes in the corporate network. Attacker movement from node to node is performed via an “attack vector”, which is an object discovered by the attacker, including inter alia an object in memory or storage of a first computer that may be used to access or discover a second computer.
Exemplary attack vectors include inter alia credentials of users with escalated privileges, existing shared location names stored on different servers and workstations, and details including the address and credentials of an FTP server, an email server, a database server or an SSH server. Attack vectors are often available to an attacker because a user did not log off from a workstation, did not log out of an application, or did not clear his cache. E.g., if a user contacted a help desk and gave a help desk administrator remote access to his workstation and if the help desk administrator did not properly log off from the remote access session to the user's workstation, then the help desk access credentials may still be stored in the user's local cache and available to the attacker. Similarly, if the user accessed a server, e.g., an FTP server, then the FTP account login parameters may be stored in the user's local cache or profile and available to the attacker.
Attack vectors enable inter alia a move from workstation A→server B based on a shared server host name and its credentials, connection to a different workstation using local admin credentials that
human being who is operating tools within the organization's net, or a cock with “ learning ” capabilities, memorize data about the environment it is operating in, such as network topology, network device and organization structure, learn “ where can I go from my current location ” and “ how can I act from my current location to another location (prerogative required) ”, learns implemented security solutions, learns applications that he can leverage, and then operate in accordance with that data. 
 An advanced attacker may practice different attack technique to enter a bodied network and to act laterally within the network in order to obtain his resource goal. The advanced attacker may begin with a workstation, server or any other network entity to start his lateral movement. He uses different methods to enter the network, including inter alia social engineering, existing exploits and vulnerabilities, and a Trojan cavalry or any other malware allowing him to master a inaugural node or nodes. 
 Once an attacker has taken control of a inaugural node in a corporate network, he uses unlike advanced attack techniques for orientation and propagation and discovery of additional ways to reach other network nodes in the corporate net. Attacker movement from node to node is do via an “ fire vector ”, which is an object discovered by the attacker, including inter alia an object in memory or repositing of a first computer that may be used to access or fall upon a second computer. 
 Exemplary attack vectors admit inter alia credentials of users with escalated privileges, existing share location name calling stored on unlike servers and workstations, and detail including the address and certificate of an FTP server, an electronic mail server, a database server or an SSH server. approach vectors are often available to an attacker because a user did not log off from a workstation, did not log out of an application, or did not clear his hoard. E.g., if a user contacted a aid desk and gave a help desk administrator remote access to his workstation and if the help desk administrator did not properly log off from the remote entree session to the user's workstation, then the help desk access credentials may still be stored in the user's local hoard and available to the attacker. Similarly, if the user accessed a server, e.g., an FTP server, then the FTP account login parameters may be stored in the exploiter's local cache or profile and available to the attacker. 
 Attack vectors enable inter alia a move from workstation A→server bel based on a shared server host name and its credentials, joining to a different workstation using local admin credentials that
 hulan being who is operatikg tools within jhw orgaiizatioh's netwofk, or a tool with “learning” cepabulititf, learns informatiun about nhe envirinmeit it is operatiif in, sugk as hctworn topology, netwprk devicev and organizadiun structure, learns “where can I go frjm my cirgent location” wnd “njw czn I move from my current location to anouher location (privolege required)”, learns implfmenhed security solutlons, learns appjucations thag he can ltvzrage, and tgen operates in accordance with that data.
An adcabcef attacker mey use different abnack tewhniquex to enter a cprpmrare network and to movx laterally within tre networn nn order to obtain hiw eesoutce gmals. Rhe adbaices attafkec may begin with a worjstation, server or snr other networi entiey to start his lateral movement. He uses gifrerent methods to enter the network, includinh inter ajia social engineering, existing exploits and vulnarabimktits, and x Tgojan horse or any other malware allowing him fo cpntrol a first node or noced.
Omse an attacket has tcieh control of a firdt node in a corporatt neteork, he uses different advabced attack nechbiques for orientacion and pro'agatipn anc discovery of additioncl waya to reach lther netsurk nodes in the cogpordte network. Attacker movemqnt from iode co node ks pgrformeq via an “ahtack vector”, which is an objeet divcovered bj the attacker, including inter ekia an objecj it mvmory or ftorane of a first cjmputer that mcy be uszd to xccess or siscovec a second cjmputer.
Exempldty attack vecvors incltde untee alia zfedentials of isers witk escqlated privileges, cxistkhg shared locatnub names stored pn aifsegenv serdars and workvtatkonr, and aetails incojdinb the address and cradenfials of an FTP setvcr, an emaul servew, a database xerver or an SSH strver. Ettack vectprs are often available to an attzcker becwusc a user did got oog off from a workstation, did not log out of an ap'lication, or did not clwar his cache. E.g., if s user contected w help devk and gave a help dwsk administrator remote access to his worksdatioj and if the help desk administrator did not properly log off from the renote arcqss session to yhe uvex's corkstaeion, vhen the help desl access credentials may still ue stored hn the user's local cache and afaklable to the attacker. Similarly, if tge user sccessed a server, e.g., an FTP serfer, then the FTP account login pqramefers may bx stored in the user'x locan cacye or peofipe and availacle tl the attwckec.
Atcack vectors enable inter alia a nove feol workstation A→sxrver B basef on a shareq server host naje ahf its credentials, vonnection to s different workstatpon using local aejin credentisls than
human being who is operating tools within network, a tool “learning” capabilities, learns is in, such as topology, network devices organization structure, learns “where can I from my current location” and “how can I move from my current location another location (privilege required)”, learns implemented security solutions, learns applications that he can and operates accordance that data. An advanced attacker may use different attack techniques to enter a corporate network and move laterally within the network in order to his resource goals. The attacker may begin with a server any other entity start lateral movement. He different methods to enter the network, including inter alia social engineering, existing exploits and vulnerabilities, and a horse or malware allowing to a node or nodes. attacker has taken control of a a corporate network, he uses different advanced attack for orientation propagation and discovery of additional ways reach other network nodes in the corporate network. movement from node to node is performed via an “attack vector”, which is an object the attacker, including inter an object in or of first that may used to access or discover a second computer. Exemplary attack vectors inter alia credentials of users with escalated privileges, existing shared stored different servers and and details including the and of an FTP server, server, database SSH Attack are often available to attacker because a user did log off from a of an application, or did not clear his E.g., if a user contacted a help and gave a help desk administrator remote access to his workstation and the help did not properly log off from the remote session to the user's then the help desk access credentials may still be in user's local and available to attacker. Similarly, if user accessed a an FTP then FTP may be stored in the user's cache profile and available to the Attack inter alia a move from workstation A→server B based on a shared server host name credentials, connection to a workstation local admin credentials that
 human being who is operating tOols within The orGanIzaTiOn's nEtwoRk, or a tool with “lEArniNg” capabilities, learns inFormaTiON aboUT tHe envIronmenT It IS OpeRaTiNg iN, sUCh As netWorK topoloGy, network dEviCeS and organizaTIoN structure, LeaRns “where can I Go fRom my cUrRenT LocatIon” And “hoW can I mOVe from My current LoCAtion tO Another LOCaTion (Privilege required)”, LEaRNs implemented sEcuritY sOLuTIOns, LeaRns applicaTiOns thAT he can lEVeRAGE, anD Then operates iN accordance WIth That daTa.
an aDVanced AttacKeR May Use differenT attAck techniQues to ENter a coRPorate nEtwork And To mOve lATeRaLly WiTHin THe NetWOrk In order tO oBtAin hiS resOURCE goaLs. THe adVanceD attacker may bEgiN witH A woRkstaTion, sErveR oR any oTher neTwork EnTity to start his lAterAl movemenT. He UsEs dIfFerenT MethodS to EntEr the neTwork, inCLudInG INTeR alia social engineeRiNG, ExIsting exPloits ANd VuLNerabiliTiEs, aNd a TROJan hoRse oR AnY other maLware aLLoWiNg him to CoNtrol a FiRst NodE or noDEs.
OnCe an atTacker haS takeN Control of a firsT Node in a corporATe NETwORk, he UseS different aDvanCEd atTack TEcHniQUes foR orieNtATiON and propagation and dIsCovery Of addItional ways to Reach other NETWork nodeS in tHE cORporate network. attacKer movemenT From node To nodE is perfoRmed via an “ATTack vectOr”, wHicH is An oBJEcT discovered by THE attAcKer, inclUdiNg inter AliA an ObjEct In Memory or sTorage of A fIrSt CoMpuTer thAT may be usEd To aCcEss Or disCOver a sEcond CompUtEr.
eXemPlary atTAcK VEctoRs InCludE inTeR alia CredENtiAls of usErs with esCalATed pRiViLeges, exIsting shared lOcAtion names StOreD on difFERent servErs and workstations, and deTAils incLudIng thE addRess and crEdeNtials Of aN fTP serVer, an eMail sErVer, A DAtabaSE SeRveR oR an SSH servER. attAck veCtOrs aRe often Available to an attacKEr bEcause a user diD noT log OFF fRom A WoRKstAtIOn, dID Not log out of an apPlication, oR dID nOt clear his CAchE. E.G., if a useR contacTed a hELp desk aNd gave a heLp desk admInIstrATOr rEmote accesS to his woRkstation ANd if tHE hElp deSk aDminisTrAtoR did nOt propERly Log ofF from tHe Remote AccesS sEssion to The user's workstation, then The helP desk AccEss credenTiaLS maY still be sToreD in the user'S loCal Cache And AVailaBle tO ThE atTAcker. simiLArly, if the USeR acCESsEd a server, e.g., AN ftP sErver, TheN The FTP AccoUnt login parameterS May be stored in tHe usER'S loCal CAche Or Profile and avaiLabLe TO The attacKeR.
Attack vectOrs enablE iNTer alIa a movE from wOrkstatION A→SErver B BaseD on A shared seRveR hOSt name aNd ItS CredenTialS, cOnnectIon to a DIffeRENt workstation usiNg locAL Admin CRedEntiaLs That
 human being who is operat ing toolswithi n t heor gani zati on's network,o r atool with “learning” c apabi li t ies, le arnsinforma t io n abo ut  t heen v ir onmen t i t is op erating in , s uc h as network to pology, ne two rk devices a ndorgani za tio n  stru ctu re, l earns“ wherecan I gofr o m my c u rrent l o c at ion”  and “how can I m o ve from my curren t loca ti o nt o  an oth er locatio n(priv i lege re q ui r e d )”, learns implem ented secur i tysoluti on s,l earnsappli ca t ion s that he c an l everage,and th e n opera t es in a ccorda nce  wi th t h at  d ata .A n a d va nce d  at tacker m ay  u se di ffer e n t atta cktech nique s to enter acor pora t e n etwor k and  tomo ve la terall y wit hi n the network i n or der to ob tai nhis  r esour c e goal s.The  advanc ed atta c ker  m a y be gin with a worksta ti o n ,server o r anyo th er networken tit y to s tarthisl at eral mov ement. He  u ses dif fe rent m et hod s t o ent e r th e netw ork, inc ludin g  inter alia so c ial engineeri n g, e xi s ting  ex ploits andvuln e rabi liti e s,  an d  a Tr ojanho r se or any other malwar eallowi ng hi m to controla first no d e or nodes .
On c ea n attacker has  take n controlo f a firs t nod e in a c orporaten e twork, h e u ses  di ffe r e nt  advanced att a c k te ch niquesfor  orient ati onand  pr op agation a nd disco ve ry  o fadd ition a l ways t orea ch  ot her n e tworknodes  inth ec orp orate n e tw o r k. A tt ac kermov em ent f romn ode  to nod e is perf orm e d vi aan  “attac k vector”, wh ic h is an ob je ctdiscov e r ed by th e attacker, including i n ter ali a a n obj ectin memory  or  stora geo f a fi rst co mpute rtha t may b e us edto  access or d isc overaseco nd comp uter.
Exemplary at t ack  vectors incl ude  int e r  a lia cr e den ti a lso f  users with esc alated pri vi l eg es, existi n g s ha red loc ation n amess tored o n differe nt server sandw o rks tations, a nd detai ls includ i ng th e  a ddres s a nd cre de nti als o f an F T P s erver , an e ma il ser ver,adatabase  server or an SSH serve r. Att ack v ect ors are o fte n  av ailable t o an  attackerbec aus e a u ser did n ot l o goff froma wo r kstation, di d n o t  l og out of a n a ppl icati on, or did  not  clear his cache. E.g., if a use r co n t act eda  hel pdesk and gavea h el p desk adm in istrator re mote acc es s  to h is wor kstati on andi f  t h e help  des k a dministra tor  d i d not p ro pe r ly log  off  f rom th e remo t e ac c e ss session to th e use r ' s wor k sta tion,  t hen the help  desk acce ss credenti als ma y st ill b e store din the  us er 's local c a che and a vaila ble toth e at tac ker. S imil a r ly, i f th euse r accesse d as er ve r , e .g.,  an F TP  ser ver, then the FTPacc o unt log in  pa r a meters ma y be storedinthe u s e r's localc ache or profi le and  avail able to the  a ttacker .
A t t ack vecto rs enable int er  ali a a move  f romwo rks ta tion A→server B  based o n a shar e d  serve r h o st n a me and  i ts credentia ls, c on n ectiont o  adiffere n t w ork sta tion  us ingl ocal admin credentials t hat
 human_being who_is operating tools within_the organization's_network,_or a_tool_with “learning” capabilities,_learns information about_the environment it is_operating in, such_as_network topology, network devices and organization structure, learns “where can I go from my_current_location” and_“how_can_I move from my current_location to another location (privilege_required)”, learns_implemented security solutions, learns applications that he can_leverage,_and then operates_in accordance with that data.
An advanced attacker may use_different attack techniques to enter a_corporate network and_to_move_laterally within the network_in order to obtain his resource_goals. The advanced attacker may begin_with a workstation, server or any other_network entity to start his lateral_movement. He uses different methods_to enter_the network, including inter alia_social engineering, existing_exploits and_vulnerabilities, and a_Trojan horse or any other malware_allowing him to_control a first node or nodes.
Once_an_attacker has taken_control_of_a first_node in a_corporate_network, he_uses_different advanced attack techniques for orientation_and_propagation and discovery of additional ways to_reach other network nodes_in_the corporate network. Attacker_movement from node to node_is performed via an “attack vector”,_which is_an object_discovered by the attacker, including inter alia an object in memory_or storage of a first computer_that may be used_to access_or_discover a second_computer.
Exemplary_attack vectors_include inter alia credentials of users with_escalated privileges,_existing shared location names stored on_different servers and workstations,_and_details including the address and credentials_of an FTP server, an email_server, a database server or_an_SSH_server. Attack vectors are often_available to an attacker because a_user did not_log off from a workstation, did not_log_out of an application, or did_not_clear his cache. E.g., if a_user_contacted_a help desk and gave_a help desk administrator remote access_to his workstation and if the help desk administrator_did not properly_log off from the remote_access_session_to the user's workstation, then the help desk access credentials_may still_be stored in_the user's local cache and available to the attacker. Similarly,_if the user accessed a server, e.g.,_an FTP server, then the FTP account login parameters may be_stored in the user's local cache or profile_and available to the attacker.
Attack vectors enable_inter alia a move_from_workstation A→server B based on a shared_server_host_name_and its credentials,_connection to a_different workstation using_local admin_credentials that