Series · 5 partsTesting the Ransomware PlaybookPart 4 · You are here
  1. 1They Do Not Break In. They Log In.
  2. 2Enumeration Cannot Be Prevented. Ask Whether It Was Seen.
  3. 3Affiliates Do Not Find Novel Paths. They Find Yours.
  4. 4The Blast Radius Is One Number. Almost Nobody Has Measured It.You are here
  5. 5The Last Two Steps Are Not in Scope. What Makes Them Survivable Is.

Lateral movement in 60 seconds

Something in the domain now has rights it should not have. The objective changes at this point, and the change is easy to miss: the affiliate stops trying to become more privileged and starts trying to be more places.

That shift matters because the two are defended differently, and almost all of the attention goes to the first one.

They do not bring tools

Lateral movement runs on SMB, WMI, WinRM and scheduled tasks. Not because those evade anything, but because they are the administrative surface — the same one the platform team uses to push agents, run inventory, and fix things at three in the morning.

So detection here is not a signature problem. Nothing needs to be identified as malicious, because nothing is malicious in isolation. It is a signal-to-noise problem, and the noise is your own operations.

Which turns “do you detect remote service creation?” into the wrong question. Event 7045 is in the log. The right question is whether anyone can tell this service creation from the forty legitimate ones the same week — and answering that requires knowing what the legitimate forty look like. Most estates have never characterised their own administrative traffic, so the answer is no, regardless of what the product claims.

The number that actually decides the outcome

Movement technique is not the multiplier. Credential reuse is.

One local administrator password, valid on every workstation, converts a single compromised host into all of them in one pass. No escalation, no new technique — the same hash, replayed. Whether that is possible is a single measurable property of the estate, and it is the property that separates an incident from an outage.

SHARED LOCAL ADMIN one hash RECOVERED ONCE host — accepted host — accepted host — accepted BLAST RADIUS every host that shares the password ONE PASS, NO ESCALATION NEEDED PER-HOST RANDOMISED one hash RECOVERED ONCE host — accepted BLAST RADIUS 1 worth exactly one machine same technique, same tooling, same detection — only the reuse changed
Nothing about the movement differs between the two halves. The affiliate runs the same commands and the same events land in the log. What differs is how far one recovered credential travels, and that is a configuration decision made years earlier.

Testing it as a measurement

The finding is not “lateral movement was possible”. It is a number.

# Recover one local admin hash, then measure how far it goes.
$ nxc smb 10.0.0.0/24 -u Administrator -H <ntlm-hash> --local-auth
SMB  10.0.0.51  [+] WS01\Administrator (Pwn3d!)
SMB  10.0.0.52  [+] WS02\Administrator (Pwn3d!)
SMB  10.0.0.53  [+] WS03\Administrator (Pwn3d!)
...

The count at the bottom of that output is the deliverable. “One recovered local administrator credential authenticated to 214 of 227 hosts” is a sentence that changes budget decisions. “Pass-the-hash is possible” is not.

Two other measurements worth taking while you are there:

# Is LAPS deployed, and where is it missing?
Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwdExpirationTime |
  Where-Object { -not $_.'ms-Mcs-AdmPwdExpirationTime' } |
  Measure-Object

# Who can read the managed passwords? This is the escalation-shaped half of LAPS.
Get-ADComputer WS01 -Properties ntSecurityDescriptor |
  Select-Object -ExpandProperty ntSecurityDescriptor |
  Select-Object -ExpandProperty Access |
  Where-Object { $_.ObjectType -ne '00000000-0000-0000-0000-000000000000' }

That second query matters because LAPS does not delete the problem, it relocates it into a DACL — the same point made in the note on edge shelf life. A per-host random password that a broad helpdesk group can retrieve on demand has a blast radius closer to the shared-password case than to one.

Where the credentials come from

Worth being precise, because the sources have very different detection profiles and get lumped together in reports:

LSASS memory. The loud one. Every endpoint product watches for handle opens against it, and this is the technique detection is tuned for — which, as part three argued, is why it is not the first choice.

The local SAM. Local account hashes, no domain privilege needed, and the source of the reuse problem above.

Cached domain credentials. Slow to crack by design, so they are a patience play rather than an immediate one.

Files nobody thinks of as credential stores. Scheduled task definitions, service configurations, deployment scripts on a share, and application config. No memory access, no alert, and in practice the most reliable of the four.

The last category is the one that survives an EDR rollout completely intact.

Evidence matrix

SignalWhat it provesNegative controlDefender verification
One approved local credential authenticates to multiple hostsCredential reuse creates a measurable blast radiusTest a LAPS-managed host and require the same credential to failCompare local administrator password/identity uniqueness across the estate
Management protocol is reachable from a user workstation segmentNetwork design permits the credential to travelBlock the protocol at the segment boundary and confirm the hop failsValidate SMB, WinRM, RDP, and remote-service paths by source and destination tier
Credential is recovered from a share, task, service, or deployment fileThe movement path survives memory protections and EDRRemove the secret and confirm the automation still works through a managed identityScan configuration stores and shares, then map each secret to owner and consumers
Same action generates recognizable authentication and service eventsThe path is detectable with existing telemetryRepeat a failed authentication and compare the event sequenceCorrelate one identity authenticating laterally to an unusual number of peers

The pattern I keep seeing

Shared local administrator passwords are almost never a decision anybody defends. They are the residue of an imaging process — a gold image built once, with a password set once, and then deployed for years. Nobody chose it; it was inherited, and rotating it means touching every machine, which is exactly the kind of work that never gets prioritised until it is prioritised by an incident.

The same shape produces the credential-in-a-file category. A deployment script needed credentials to run unattended, someone put them in the script, the script went on a share so the automation could reach it, and the share is readable by everyone because that was the fastest way to make it work.

What to hand the defenders

The number, first. How many hosts accepted one credential. Everything else in this section is context for that figure.

The baseline gap, second. If nobody can distinguish your movement from routine administration, say it as its own finding. It is fixable — characterise which accounts legitimately perform remote execution, from which sources, on what schedule — and it makes every subsequent detection rule possible. Without it, no rule can be written that does not drown the analyst.

LAPS with the read rights checked. Recommending LAPS without auditing who can read the passwords produces a deployment that satisfies the finding and leaves the blast radius unchanged.

Next, and last in this series: the part testing does not cover — exfiltration and encryption, and why the finding that would have stopped them is upstream of both.

Sources & freshness

How current is this note?

Sources checkedJanuary 16, 2026

The latest source-review, content-update, or publication date is shown.

ReviewAuthor review complete

The author completed a technical review. This does not, by itself, claim lab reproduction.