602-725-2818Licensed, insured & bondedSchedule a Consultation
Call 602-725-2818Consultation
sales@honeybadgersolution.com
sales@honeybadgersolution.com Cart

Credential Theft and Lateral Movement on Windows: How Intruders Move Through a Network

/ Cybersecurity & Threat Intelligence / By

Most serious breaches are not a single dramatic exploit. They are a quiet progression. A threat actor lands on one ordinary workstation through a phishing email or an exposed service, and from that single foothold begins a patient campaign to harvest credentials, escalate privilege, and spread across the network until it reaches the systems that matter: domain controllers, file servers, backup infrastructure, and the crown-jewel data.

In Windows and Active Directory (AD) environments, that progression follows a well-worn path. Intruders rarely need a brand-new zero-day. Instead, they abuse the way Windows authentication is designed to work, borrowing credentials and authentication tokens that are already present on the machines they compromise. Understanding how credential theft and lateral movement actually happen, at a conceptual level, is the first step toward detecting and stopping them.

This article explains the techniques defenders most need to understand, maps them to the MITRE ATT&CK framework, and lays out the detection and hardening measures that break the attack chain. It is written for defenders. It describes what adversaries do and why it works, not how to do it.

Why Windows and Active Directory Are Prime Targets

Active Directory is the identity backbone of most enterprises. It authenticates users, authorizes access to resources, and enforces policy across thousands of machines from a handful of domain controllers. That centralization is enormously efficient for administrators, and equally attractive to an attacker: compromise the directory, and you effectively own the organization.

The attack surface is broad. Windows authentication relies on reusable secrets, such as password hashes and Kerberos tickets, that must be available on endpoints to support single sign-on and network services. Those secrets are exactly what an intruder wants. Once a hacker steals a credential that is valid somewhere else on the network, the compromise stops being about one machine and becomes about the domain. This is why the difference between a contained incident and a full-scale breach so often comes down to how well an organization limits credential exposure and privilege.

The MITRE ATT&CK knowledge base organizes these behaviors into tactics, including Credential Access (how adversaries steal account material) and Lateral Movement (how they use it to reach new systems). Thinking in those terms helps defenders anticipate the next move rather than react to each event in isolation.

The Anatomy of Credential Theft

Before an intruder can move laterally, they generally need credentials beyond the one account they entered with. Credential theft on Windows takes several conceptual forms.

LSASS Memory Dumping

The Local Security Authority Subsystem Service (LSASS) is the Windows process responsible for enforcing security policy and handling authentication. To support features like single sign-on, LSASS may hold credential material, including password hashes and Kerberos tickets, in memory for accounts that have logged on to the system.

If an attacker gains administrative or SYSTEM-level rights on a machine, they can attempt to read or copy the contents of LSASS memory and extract that credential material offline. MITRE ATT&CK tracks this as OS Credential Dumping: LSASS Memory (T1003.001). The freely available tool Mimikatz is the best known utility associated with this technique, and it is widely cited in incident reports and threat intelligence. Defenders should recognize the name because it appears constantly in detection rules and post-incident analysis, but the important point here is conceptual: credentials that live in memory can be harvested by anyone who achieves sufficient privilege on the host.

This is also why local administrator rights are so consequential. Local admin on a shared machine is not just control of that machine. It is potential access to every credential that has touched it.

Cached Credentials, Tokens, and Credential Databases

LSASS is not the only source. Windows caches domain credentials locally so users can log on when a domain controller is unreachable. The local Security Account Manager (SAM) database stores local account hashes. On a domain controller, the AD database file (NTDS.dit) contains the password hashes for every account in the domain, which is why protecting domain controllers and their backups is paramount. Attackers may also steal or reuse access tokens created during interactive logons to impersonate other users.

Each of these represents stored or in-memory secrets that, once obtained, feed directly into the lateral movement techniques below.

How Attackers Move Laterally

With stolen credential material in hand, a threat actor pivots. The signature of Windows lateral movement is that adversaries frequently do not need to crack a password at all. Windows authentication protocols will often accept the underlying secret, such as a hash or a ticket, directly.

Pass-the-Hash

Windows systems that support NTLM authentication can authenticate a user by proving knowledge of the password’s hash rather than the plaintext password itself. In a pass-the-hash attack (T1550.002, Use Alternate Authentication Material: Pass the Hash), an intruder who has stolen an account’s NTLM hash presents it to remote systems to authenticate as that user, with no need to know or crack the actual password.

The danger multiplies when the same local administrator password, and therefore the same hash, is reused across many machines. A single harvested hash can then unlock a large swath of the environment. Pass-the-hash is a foundational lateral movement technique precisely because it turns one compromised endpoint into a master key.

Pass-the-Ticket

Kerberos, the primary authentication protocol in modern AD, issues tickets that prove a user’s identity to services. In a pass-the-ticket attack (T1550.003), an adversary steals Kerberos tickets from a compromised host, such as ticket-granting tickets (TGTs) or service tickets, and reuses them to access resources as the victimized user.

The most severe variants involve forging tickets after an attacker has obtained the right key material. A so-called “golden ticket,” for example, becomes possible if an intruder compromises the domain’s KRBTGT account key, allowing them to mint tickets for arbitrary users. These attacks represent deep domain compromise and are a major reason domain controller security is treated as the highest priority.

Kerberoasting

Kerberoasting (T1558.003, Steal or Forge Kerberos Tickets: Kerberoasting) is a clever abuse of normal Kerberos behavior. Any authenticated domain user can request a service ticket for an account that has a Service Principal Name (SPN) registered, and part of that ticket is encrypted with a key derived from the service account’s password.

An attacker requests these tickets and takes them offline to attempt to crack the associated password without triggering the failed-logon alerts that online guessing would generate. Service accounts are prime targets because they often have elevated privileges, weak or non-expiring passwords, and stale configurations. A cracked service account password can hand an intruder a powerful, often overprivileged identity, a common stepping stone in privilege escalation toward domain dominance.

NTLM Relay

Rather than steal a credential outright, an attacker can position themselves to relay an authentication attempt. In an NTLM relay attack (a form of Adversary-in-the-Middle, T1557, with LLMNR/NBT-NS Poisoning and SMB Relay tracked as T1557.001), the adversary captures authentication traffic, often coaxed out of victim machines by abusing legacy name-resolution protocols, and forwards it to another system to authenticate as the victim.

Because the attacker relays the authentication in real time, they never need to know the password or hash at all. NTLM relay thrives where legacy protocols remain enabled and where SMB signing and channel-binding protections are not enforced.

Active Directory Misconfigurations That Widen the Attack Surface

Techniques get the headlines, but misconfiguration is what makes them devastating. Adversaries succeed by chaining together small weaknesses, and mature AD environments accumulate these over years. Common conditions that expand the attack surface include:

  • Excessive privilege and sprawling admin groups. Too many accounts in Domain Admins, or highly privileged accounts used for everyday tasks, mean a single compromised endpoint can expose domain-wide credentials.
  • Credential reuse across tiers. When administrators log on to ordinary workstations with privileged accounts, they leave harvestable credentials on the least trustworthy machines.
  • Shared, static local administrator passwords. Identical local admin credentials across endpoints make pass-the-hash trivial to scale.
  • Weak or stale service accounts. Overprivileged service accounts with weak passwords are the fuel for Kerberoasting.
  • Legacy protocols left enabled. Unnecessary NTLM, LLMNR, and NBT-NS support keep relay and poisoning attacks viable.
  • Insecure delegation and permission misconfigurations. Overly permissive access control entries and unconstrained delegation can create hidden paths to escalate privilege.
  • Weak monitoring and long dwell times. When authentication anomalies go unwatched, intruders operate for weeks undetected.

CISA and international partners catalog these issues, along with concrete detection and mitigation strategies, in their guidance on detecting and mitigating Active Directory compromises. It is essential reading for anyone responsible for an AD environment.

Detection and Hardening: Closing the Doors Intruders Use

The good news is that the same techniques that make Windows lateral movement effective also create detectable signals and well-understood defenses. Hardening is about raising the cost of each step and shrinking the blast radius when one step succeeds. No single control is sufficient; defense in depth is the goal.

Protect Credentials in Memory

Microsoft provides platform features specifically designed to keep credential material out of an attacker’s reach. Credential Guard uses virtualization-based security to isolate secrets such as NTLM hashes and Kerberos ticket-granting tickets so that even code running with high privilege on the host cannot readily access them. It is a direct countermeasure to the credential-dumping and reuse techniques described above.

Complementing this, Windows supports additional LSA protection (running LSASS as a protected process), which makes it substantially harder for unauthorized code to read LSASS memory. Endpoint detection and response (EDR) tooling and Microsoft Defender attack surface reduction rules can further flag or block suspicious access to LSASS. Together, these measures attack the root of the problem: if credentials cannot be harvested, they cannot be replayed.

Adopt Tiered Administration and Least Privilege

One of the most effective structural defenses is a tiered administration model that separates privileged accounts by the sensitivity of the systems they manage. In practice, this means domain-admin-level credentials are never used to log on to ordinary workstations, and administrative accounts are segmented so that a compromise in one tier does not expose credentials for another.

Pair this with disciplined least privilege: minimize membership in highly privileged groups, use dedicated privileged access workstations for sensitive administration, and remove standing local administrator rights from everyday user accounts. This directly limits how far a stolen credential can travel and undercuts pass-the-hash at scale.

Require Phishing-Resistant MFA

Because so many intrusions begin with a stolen or phished password, strong multi-factor authentication (MFA) is foundational. Not all MFA is equal, however. CISA specifically urges organizations to adopt phishing-resistant MFA, such as FIDO2 or PKI-based authenticators, which cannot be defeated by the credential-phishing and push-fatigue techniques that undermine weaker second factors. Prioritizing phishing-resistant methods for privileged and remote-access accounts closes one of the most common front doors.

Randomize and Rotate Local Administrator Passwords

To defeat the credential reuse that makes pass-the-hash so scalable, deploy the Windows Local Administrator Password Solution (Windows LAPS), a built-in Microsoft capability that automatically sets a unique, random local administrator password on each machine and manages it centrally. When every endpoint has a different local admin secret, a hash stolen from one host no longer unlocks the rest.

Harden Kerberos, NTLM, and Service Accounts

Reduce the Kerberoasting attack surface by treating service accounts as privileged assets: use long, complex, managed passwords (group Managed Service Accounts are designed for this), grant only the privileges each account genuinely needs, and audit SPNs and stale accounts. Where possible, retire legacy protocols, enforce SMB signing, and restrict or disable NTLM to blunt relay attacks, then monitor for the authentication anomalies that remain.

Monitor for the Signals of Lateral Movement

Detection is where hardening meets operations. Credential theft and lateral movement leave traces if you are watching for them. High-value signals include anomalous authentication patterns, such as a single account logging on to an unusual number of hosts in a short window, unexpected use of administrative logon types, and unusual service-ticket request patterns consistent with Kerberoasting. Suspicious process access to LSASS, creation of new privileged accounts, and changes to sensitive AD groups all warrant alerts.

Effective monitoring depends on centralized, tamper-resistant logging from endpoints and domain controllers, correlated in a SIEM and tuned against a baseline of normal behavior. MITRE ATT&CK provides detailed detection guidance for each technique, giving security teams a concrete map of what to hunt for and which data sources to collect. The objective is to shorten dwell time so that a foothold is caught before it becomes a full breach.

Conclusion

Credential theft and lateral movement are the connective tissue of modern intrusions on Windows networks. A threat actor rarely needs an exotic exploit; more often, they abuse the reusable secrets and trust relationships that Active Directory relies on to function, turning one compromised endpoint into a path to the entire domain. The defenses are equally well understood: protect credentials in memory with Credential Guard and LSA protection, enforce tiered administration and least privilege, require phishing-resistant MFA, randomize local administrator passwords, harden Kerberos and legacy protocols, and monitor relentlessly for the signals these techniques produce.

Getting this right is demanding, and the details matter. Honeybadger Solutions LLC helps organizations close these gaps, whether through an Active Directory security assessment that surfaces the misconfigurations attackers look for, incident response when an intrusion is already underway, or digital forensics to determine exactly what a breach touched. As a Service-Disabled Veteran-Owned Small Business focused on cybersecurity, incident response, digital forensics, and private investigations, we bring an operator’s mindset to hardening your environment before an adversary tests it. If you want to understand and reduce your attack surface, we would welcome the conversation.

About Honeybadger Solutions

Honeybadger Solutions LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering cybersecurity, digital forensics, and investigative services to clients nationwide. Whether you are dealing with a compromised device, a suspected intrusion, or you simply want to get ahead of these threats, our team can help.

What we do:

  • Digital forensics — mobile devices (iPhone, Android) and computers (Windows, macOS, Linux); intrusion reconstruction, evidence preservation, and expert-witness reporting
  • Cybersecurity & incident response — breach investigation, containment, malware and spyware analysis, and remediation
  • Penetration testing & security assessments — finding the gaps before an attacker does
  • Managed IT & endpoint security — hardening, monitoring, and patch management for small and mid-sized organizations
  • Private investigations — including TSCM / technical surveillance countermeasures (“bug sweeps”)
  • Executive & personal protection

📞 (602) 725-2818 · 🌐 honeybadgersolution.com · Veteran-Owned (SDVOSB) · Licensed & Insured

Concerned a device or network may already be compromised? Contact Honeybadger Solutions for a confidential consultation — we handle mobile and computer forensics, incident response, and everything above.

Related from the Honeybadger Windows computer-security series

Part of Honeybadger Solutions’ security-intelligence series. Explore the rest of the Windows coverage:

Sources

Something that cannot wait for business hours? Urgent and after-hours intake — read seven days a week. If anyone is hurt or in immediate danger, call 911.