TL;DR
http://www.fireeye.com/blog/threat-research/2015/08/malware_lateral_move.html
https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf
- Internal reconnaissance
- Netstat
- IPConfig/IFConfig
- ARP cache
- Local Routing table
- PowerShell
- Credentials harvesting
- “pass the hash”
- Stealing of plaintext passwords from the memory of the machine using tools like Mimikatz
- create a Kerberos ticket “Golden Ticket” which will then allow the malicious actor to add accounts to your domain, elevate their privileges and make many other unauthorized changes.
- Keylogging
- Utilizing certificate capture tools like Mimikatz to harvest authentication certificates from compromised machines
- Pivoting attacks to compromise other hosts
- Using built-in system tools like Remote Desktop Protocol (RDP), AT, PsExec, VBScript and using open source tools like Metasploit.
- built-in Windows tool PowerShell and WMI
