Lateral Movement Techniques 2026 — Execute Every BloodHound Attack Path in AD | Hacking Course Day 28

This educational guide teaches practical execution of Active Directory lateral movement attacks by implementing the attack paths identified through BloodHound in Day 27. It covers four primary lateral movement techniques (PSExec, WMI, WinRM, DCOM) with different operational characteristics, port requirements, and detection signatures, enabling penetration testers to traverse compromised networks efficiently while understanding the forensic footprint each technique leaves. The material demonstrates how to chain credential dumping, network sweeping, and lateral moves into a cascading pipeline that progressively escalates access toward Domain Admin.

• Four execution techniques with distinct tradeoffsPSExec uses port 445 to create a Windows service (Event 7045), providing SYSTEM-level shell but generating high noise detectable by most EDR. WMI executes via port 135 without service creation, leaving smaller footprint but running as Administrator only. WinRM provides interactive PowerShell over port 5985 with full session capabilities. DCOM uses port 135 with lowest noise, leveraging legitimate COM objects. Choice depends on monitoring posture and operational requirements.
• Impacket tools implement multiple authentication methodsAll four lateral movement tools (psexec, wmiexec, secretsdump) accept either plaintext credentials (username:password) or NTLM hashes with the -hashes flag, enabling Pass the Hash attacks without needing decrypted passwords. This allows attackers to use hashes extracted from compromised systems to immediately authenticate to other machines, creating seamless credential cascade workflows.
• Credential dump → move → dump pipeline architectureThe article presents a five-phase operational cycle: CrackMapExec identifies accessible machines with current credentials, PSExec or WMI moves to a target, secretsdump remotely extracts SAM hashes without needing interactive shell, new hashes are tested against remaining subnet via CrackMapExec, and BloodHound is updated to recompute shortest paths from newly owned systems. This cascading approach is presented as the standard workflow in professional internal penetration tests.
• Evil-WinRM provides Linux-based interactive sessionsEvil-WinRM is a Kali Linux tool that establishes interactive PowerShell sessions over WinRM, offering features absent from basic impacket-wmiexec including tab completion, file upload/download capability, and in-memory PowerShell script loading without disk writes. It supports both plaintext passwords and Pass the Hash using the -H flag, making it the preferred tool for WinRM-based lateral movement from Linux attacking infrastructure.
• Detection signatures tied to specific technique choicesPSExec generates Event ID 7045 (new service creation), detectable by most EDR products. WMI generates Event IDs 4688 (new process) and 4648 (explicit credential use) with no service creation. WinRM generates WSMan events. Understanding these Event IDs informs technique selection during engagements with active monitoring—smaller footprint techniques like WMI or DCOM avoid PSExec's well-known EDR signature, while WinRM provides full capabilities for complex operations where detection risk is understood.
• BloodHound edges map to execution techniquesThe article frames BloodHound graph edges as operational requirements: AdminTo edges (user has local admin on a machine) can be traversed using PSExec, WMI, WinRM, or DCOM depending on open ports and acceptable noise. HasSession edges (interesting user logged on to a machine you have admin on) require credential dumping before lateral moves. This connection between graph analysis and specific execution methods structures the attack planning process.
• Technique selection framework for engagement scenariosThe article presents three decision scenarios: high-monitoring environments require techniques with smallest footprint (DCOM or WMI over PSExec); hash-based attacks without plaintext passwords use impacket-psexec with -hashes flag; interactive operations from Kali use Evil-WinRM for best user experience. This framework demonstrates that skilled operators choose techniques based on operational context—detection risk, available credentials, required interactivity—rather than always using one tool.
• Lab-based pipeline execution establishes operational workflowThe article prescribes hands-on exercises using TryHackMe or isolated AD labs to practice the full lateral movement cycle: CrackMapExec identification, PSExec/WMI/Evil-WinRM shell access, secretsdump credential extraction, subnet-wide hash testing, and progression to next machines. Documenting which ports each technique required and which Event IDs appeared builds detection awareness necessary to write actionable client recommendations in penetration test reports.

Bottom line: Effective Active Directory penetration testing requires selecting appropriate lateral movement techniques (PSExec, WMI, WinRM, DCOM) based on detection posture and operational context, then chaining them with credential dumping and network sweeping into a cascading pipeline that progressively escalates access. Understanding the specific port requirements, privilege levels, and Windows Event ID signatures each technique generates enables both successful compromise and accurate reporting of detect