Windows Lateral Movement Attack Playbook

Problem Addressed

In enterprise Windows and Active Directory environments, lateral movement is often the hardest part to reason about when assessing a breach, validating privilege boundaries, or reviewing credential-abuse risk. Base models frequently stop at “you could use a tool,” but miss the credential requirements, execution fingerprints, and OPSEC trade-offs between methods. This skill places PsExec, WMI, WinRM, DCOM, SMB, RDP, SSH, pass-the-hash, overpass-the-hash, and pass-the-ticket in one map, helping engineers understand which credential each path relies on, what execution traces it leaves, and where EDR/AV boundaries may interrupt the flow.

How It Works

Instead of listing tools, the skill organizes content by method family, credential type, execution path, and detection footprint. It starts with routing: after landing on a new host, decide whether to consider windows-privilege-escalation; if EDR blocks a tooling path, evaluate windows-av-evasion; if Kerberos delegation or ACL paths matter, bring in active-directory-kerberos-attacks and active-directory-acl-abuse. When credential context is needed, it also points to CREDENTIAL_DUMPING.md, covering related background such as LSASS, SAM/SYSTEM/SECURITY, DPAPI, and NTDS.dit, rather than generating actionable attack steps.

Boundaries

This skill is best used for technical research, authorized penetration testing, security review, and red/blue team method analysis. It is not a general Windows troubleshooting runbook. Users should operate only under explicit authorization, with attention to credential provenance, log visibility, execution footprint, and least privilege.