Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.

SKILL: Windows Lateral Movement — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Windows lateral movement techniques. Covers PsExec, WMI, WinRM, DCOM, SMB, RDP, SSH, pass the hash, overpass the hash, pass the ticket, and pivoting. Base models miss execution method fingerprints, OPSEC trade offs, and credential type requirements per method. 0. RELATED ROUTING Before going deep, consider loading: [windows privilege escalation](../windows privilege escalation/SKILL.md) after landing on a new host for local escalation [windows av evasion](../windows av evasion/SKILL.md) when EDR blocks lateral movement tools [active directory kerberos attacks](../active directory kerberos attacks/SKILL.md) for Kerberos based lateral (pass the ticket, delegation) [active directory acl abuse](../active directory acl abuse/SKILL.md) for ACL based paths to new hosts Advanced Reference Also load [CREDENTIAL DUMPING.md](./CREDENTIAL DUMPING.md) when you need: LSASS dump techniques (MiniDump, comsvcs.dll, nanodump) SAM/SYSTEM/SECURITY extraction DPAPI, credential manager, cached domain credentials NTDS.dit extraction methods 1. REMOTE EXECUTION METHODS COMPARISON Method Port Cred Type Creates Service? File on Disk? OPSEC Admin Required? PsExec 445 (SMB) Password/Hash Yes (PSEXESVC) Yes (.exe) Low Yes Impacket smbexec 445 Password/Hash Yes (temp service) No Medium Yes Impacket atexec 445 Password/Hash No (scheduled task) No Medium Yes WMI 135+dynamic Password/Hash No No High Yes WinRM 5985/5986 Password/Hash/Ticket No No High Yes (Remote Mgmt) DCOM 135+dynamic Password/Hash No No High Yes RDP 3389 Password/Hash (RestrictedAdmin) No No Low (GUI session) RDP access SSH 22 Password/Key No No High SSH enabled SC 445 Password/Hash Yes (custom service) Yes Low Yes 2. PSEXEC VARIANTS Impacket PsExec Impacket smbexec (Stealthier — No Binary Upload) Impacket atexec (Scheduled Task) Sysinternals PsExec 3. WMI LATERAL MOVEMENT 4. WINRM LATERAL MOVEMENT 5. DCOM LATERAL MOVEMENT Stealthy — uses legitimate COM objects, no service creation. MMC20.Application ShellWindows ShellBrowserWindow Impacket dcomexec 6. PASS THE HASH (PTH) Use NTLM hash directly without knowing the plaintext password. Enable Restricted Admin for RDP PTH 7. OVERPASS THE HASH (PASS THE KEY) Convert NTLM hash → Kerberos TGT → pure Kerberos authentication. Advantage : Pure Kerberos auth avoids NTLM logging and detection. 8. PASS THE TICKET 9. PIVOTING THROUGH COMPROMISED HOSTS SSH Tunnel / Port Forward Chisel (No SSH Needed) Ligolo ng (Modern, Fast) 10. LATERAL MOVEMENT DECISION TREE

windows-lateral-movement