Lateral movement

As explained in Azure Security

Lateral movement is an attack technique in which an adversary moves from one compromised resource or account to additional resources within an environment.

Lateral movement is an attack technique in which an adversary uses one compromised resource or account to reach additional resources. In a cloud environment, movement may spread across virtual machines, databases, storage, IoT devices, and other resource types, increasing the potential impact of a breach. section 1.5

Reduce the opportunity for lateral movement by combining controls across the attack path:

• Protect identities with Microsoft Entra ID, detect suspicious logins, and require multifactor authentication when appropriate. section 1.8.1
• Apply additional protection to privileged identities, including password changes when identity protection detects possible compromise. section 1.8.1
• Use Microsoft Sentinel to detect suspicious behavior and contain it through automated response. section 1.8.1
• Secure workloads, monitor continuously, investigate suspected compromise, respond, and incorporate findings into the next security cycle. section 1.3

From an exposed VM to broader compromise

A virtual machine with publicly accessible ports and weak account protection can expose credentials to attack. After compromising the VM account, an adversary may move into other resource types, establish broader control, and pursue an objective such as installing a crypto miner or demanding ransom. section 1.5

Figure 1.2 The kill chain model helps visualize the steps that bad actors may perform to compromise your Azure environment.

Use the kill chain visualization to locate lateral movement between initial access and actions on the objective. section 1.5

Figure 1.5 Azure security services that can be used to secure identities in your Azure environment

Use the identity-security diagram to connect suspicious identities, MFA, privileged access protection, and automated containment. section 1.8.1

How Azure Security covers it

How deep it goes

Explains the technique, affected resource types, kill-chain position, and layered defenses but stops short of procedural configuration steps.

Examples

Uses an exposed virtual machine, compromised account, cross-resource spread, crypto mining, and ransom as concrete attack examples.

What it assumes

Assumes basic awareness of cloud resources, identities, and attacks while explaining lateral movement and its security context directly.

What you can do after

Diagnose potential lateral movement by monitoring suspicious activity, investigating compromise, responding with containment, and strengthening future workload security.

How it connects

Connects lateral movement with the kill chain model, compromised identities, Microsoft Entra ID, MFA, Microsoft Sentinel, and ransomware.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  100 SQL Server Mistakes and How to Avoid ThemLateral movement is an attacker's progression from one compromised system or account to additional systems within an environment.
• 

  liveBookmanning.com
  Secure APIsLateral movement is an attacker's progression between systems or network segments after gaining an initial foothold.

Compare how 3 books explain lateral movement →

Related concepts

• kill chain modelpart of · An attack model that represents the sequence of stages an attacker may follow from exposure and access through movement and actions to an objective and goal.
• network segmentationaddressed by · Network segmentation is the division of a network into distinct physical or logical zones with controlled communication between them.
• cloud security graphused by · The cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.