XcellSecure|Lateral Movement
One stolen login should never become the keys to your whole network.
Attackers rarely land where the valuable data is. They land on a laptop, then hop — server to server, account to account — until they reach your domain controller and backups. We cut the paths, watch the ones that must stay open, and contain fast.
The first machine is rarely the target. It's the doorway.
Lateral movement is everything an intruder does between getting in and getting what they came for. They use your own admin tools and real accounts, so each step looks like ordinary IT work — until you line the steps up.
- 01Foothold
A phished password, an infostealer log or an unpatched VPN gives access to one device or account.
TA0001 · T1078 - 02Discover
They list domain admins, servers, file shares and trust relationships — quietly, using built-in commands.
T1087 · T1018 · T1482 - 03Harvest
Cached passwords, hashes and Kerberos tickets are pulled from memory or cracked from weak service accounts.
T1003 · T1558.003 - 04Hop
Those credentials open RDP, admin shares and remote management on the next machine. Repeat.
T1021 · T1550 · T1570 - 05Crown jewels
Domain controller, hypervisors, databases and backups — then data theft or ransomware across everything at once.
T1486 · T1490
Every hop uses a valid account and a normal protocol — RDP, SMB, WinRM, PowerShell. Antivirus has nothing to flag. Perimeter firewalls never see it, because the traffic never leaves your network.
Lateral movement is what turns a single infected laptop into a company-wide outage. Stop it and a phishing click stays a one-laptop incident: reimage, reset, move on.
Fewer paths (hardening), fewer reusable secrets (identity), and eyes on what's left (NDR, UEBA, SOC) — so each hop costs the attacker time and trips an alarm.
The techniques, in plain language. And the control that blunts each one.
Lateral Movement is tactic TA0008, with nine techniques. It sits between Discovery and Credential Access on one side and Impact on the other — so we map the neighbours too. Pick a tactic.
Technique IDs from attack.mitre.org (Enterprise v20; TA0008 page checked 10 November 2026). Descriptions are XcellHost's defensive summaries, not MITRE text, and not a coverage score.
The numbers behind the hops. Sourced and dated.
No single statistic measures lateral movement. These are the official and widely cited figures that describe its ingredients: stolen access, slow patching, slow detection and ransomware at the end of the chain.
IBM figures are for India from the 2026 Cost of a Data Breach study (Ponemon Institute). Microsoft figures cover July 2025 to June 2026. Verizon's 2026 DBIR analysed over 22,000 confirmed breaches. We quote; we don't extrapolate.
What lateral movement looks like in your logs and on the wire.
Each signal alone can be innocent. Two or three on the same account or host within an hour rarely are. The tag shows where we see it.
Laptops seldom need SMB or RDP to each other. A sudden fan-out to many peers is a classic hop.
NDR · firewall logsA server admin interactively signing in to a laptop, or a helpdesk account touching servers at 2 a.m.
UEBA · Windows 4624Many service tickets with weak RC4 encryption from one user in minutes — a sign of Kerberoasting.
DC logs · 4769Tools or scripts opening the credential store process, or creating memory dumps on a server.
EDRNew services, scheduled tasks or WMI/WinRM commands pushed to another machine by a user account.
EDR · 7045 · 4698Executables or scripts landing in C$ or ADMIN$ on several hosts, often with the same name.
NDR · EDROne account querying every group, computer and trust in Active Directory — far more than its job needs.
Defender for Identity · UEBALogons to the backup server, deleted shadow copies or changed retention — often the last step before encryption.
Backup console · EDROne laptop is compromised. How far can the attacker get?
A typical mid-size network with eleven known paths between systems. Switch on the controls you already have. We recalculate what's reachable from the phished laptop, how many hops it takes to reach the domain controller, and which alarms would ring on the way.
Prevent · removes paths
Detect · adds alarms
Illustrative model, sample network. An edge disappears when any one of its listed controls is on; real networks have many more paths, which is why an AD assessment or breach & attack simulation maps yours properly.
Prevent, detect, respond, recover. Each layer buys the next one time.
No single product stops lateral movement. Each column below lists the controls that matter most, linked to the XcellHost service that delivers them.
- Tiered admin: domain admins only on domain controllers · AD Assessment
- Unique local admin passwords with Windows LAPS · Intune
- Phishing-resistant MFA and Conditional Access for every admin · Managed Identity
- Just-in-time admin, vaulted service accounts · PAM · PIM
- East-west allow-listing · Guardicore* · CNAPP
- Patch internal services fast · Patch management
- EDR with credential-theft protection · Defender · Scrutiny EDR
- East-west traffic analytics · NDR
- Baselines for every account · UEBA
- Correlated detections across identity, endpoint and network · NG-SIEM
- Decoy accounts and honeytokens on likely paths
- 24×7 triage and containment · Security Operations
- Isolate hosts through EDR, block paths through firewall and NAC · NAC
- Disable accounts, revoke sessions, reset secrets in order
- Evidence, timers and CERT-In decisions in one case · Case Management
- Forensics when it's serious · DFIR
- Backups off the domain, with an immutable copy · Veeam · Commvault
- Directory and cloud identity backup · Entra ID backup
- Clean-room recovery site · Cloud DR
- Rotate the KRBTGT key twice, in a controlled way
- Post-incident review and board report · vCISO
You've spotted a hop. Here are the first 60 minutes.
Tick actions as you take them. Enter when you noticed the incident and we work out your CERT-In reporting deadline. Download the checklist for your runbook.
30 days to close the easy paths. 90 to make hopping loud and slow.
Ordered by risk removed per rupee. Most of the first month is configuration of tools you already pay for.
Cut the shortcuts
- AD attack-path assessment: who can reach domain admin, and how
- Windows LAPS on every PC and server
- MFA on all admin, VPN and remote-access logons
- Remove stale admins; separate admin accounts from daily ones
- Take backup servers off the domain; check one restore
Harden the identity tier
- Tier 0/1/2 admin model; no domain admin on workstations
- PAM for privileged and service accounts; rotate weak ones
- EDR in block mode with LSASS protection everywhere
- Block workstation-to-workstation SMB and RDP
- Patch SLAs for internal services
Watch what's left
- NDR sensor on the data-centre core
- UEBA baselines on admin and service accounts
- Correlated alerts in the SIEM, 24×7 triage
- Microsegment crown-jewel servers
- Breach & attack simulation to prove it
Every control on this page has a service behind it.
Mapped to the XcellHost pages that deliver it. Pick by layer; we integrate them into one SOC view.
Identity
Network
* Partner or third-party products, trademarks of their owners. XcellHost is a Microsoft Gold Partner.
Regulators ask for the same evidence this work produces.
Logs that show who went where, proof of least privilege and a tested response. Compliance stays your responsibility; we hand you the artefacts.
Report specified incidents within 6 hours of noticing; keep ICT logs for 180 days in India. Lateral-movement evidence lives in those logs — authentication, EDR and network metadata.
Reasonable security safeguards and breach intimation to the Data Protection Board and affected people. Breach duties apply from 13 May 2027. DPDP platform →
RBI's IT governance directions (Nov 2023) and SEBI's CSCRF (Aug 2024) expect privileged-access control, network segmentation and continuous monitoring. Our reports map to those controls.
Privileged access rights and segregation of networks are Annex A controls; tiered admin and microsegmentation give auditors clear evidence.
Assess the paths. Close them. Or have us watch them 24×7.
Each bundle is built from existing XcellHost services at their published prices. Indicative, excl. 18% GST; Microsoft licences billed separately.
- AD Assessment, per forest₹74,999
- BAS Readiness Assessment₹49,999
Attack paths to domain admin, ATT&CK coverage map, gap report and 90-day plan.
- Managed Identity Professional₹199
- Managed Defender Essential₹199
MFA, Conditional Access, admin hygiene and EDR hardening, with 24×7 EDR alert triage.
- Managed Identity Professional₹199
- Security Operations Professional₹449
Everything in Protect plus 24×7 SOC detection, containment and remediation across identity, endpoint and network.
Component prices as published on AD Assessment, Breach & Attack Simulation, Managed Identity, Microsoft Defender and Security Operations — indicative, excl. 18% GST. Onboarding fees, PAM, NDR and UEBA are add-ons in the configurator; NDR is a placeholder price — confirm with XcellHost.
Build your bundle. See the first invoice.
Users, devices and add-ons. First invoice = one-time items plus the first month.
Lateral Movement · Protect
Prices as on the linked XcellHost pages; NDR sensor price is a placeholder — confirm with XcellHost. Excl. 18% GST in the lines above. Microsoft and partner licences quoted separately.
Lateral movement, answered.
It is the stage of an attack where an intruder who has access to one device or account moves to others inside the same network — usually by reusing stolen credentials over normal admin protocols such as RDP, SMB and remote management — until they reach high-value systems like the domain controller, databases or backups. MITRE ATT&CK tracks it as tactic TA0008.
Because each step uses legitimate accounts and built-in tools, there is often no malicious file to detect, and the traffic stays inside your network where perimeter firewalls don't look. Stopping it takes identity hardening, internal segmentation and behaviour-based detection — EDR, NDR and UEBA — watched by people.
Windows can accept a password's hash instead of the password itself. If an attacker copies that hash from one machine's memory, they can sign in to other machines where the same account works — without ever knowing the password. Unique local admin passwords (Windows LAPS), credential protection on endpoints and keeping admin accounts off workstations break that chain. ATT&CK lists it as T1550.002.
A rule that admin accounts only sign in at their own level: domain admins only on domain controllers, server admins only on servers, and helpdesk accounts only on workstations. That way a compromised laptop never holds credentials that can unlock servers or the domain. It costs little and removes the most common path to domain admin.
VLANs separate broad zones; microsegmentation controls which specific servers and ports may talk to each other, even inside a zone. Start by blocking workstation-to-workstation SMB and RDP and isolating backups; then microsegment crown-jewel servers with a platform such as Akamai Guardicore* or, in the cloud, our CNAPP service.
It depends on what's deployed. With EDR on every device, identity analytics and our 24×7 SOC on the Managed bundle, alerts are triaged around the clock and hosts can be isolated through EDR without waiting for business hours. We agree response times in your contract rather than quoting a generic figure here.
CERT-In's 28 April 2022 directions list reportable incident types — including compromise of critical systems, unauthorised access to IT systems and data, and ransomware — to be reported within 6 hours of noticing. An attacker moving between your servers usually falls in that list. Our playbook prepares the evidence for that decision; the decision and filing remain yours.
If personal data is affected, you must notify the Data Protection Board and affected individuals; the DPDP Rules, 2025 set a 72-hour window for the detailed report to the Board. These breach duties apply from 13 May 2027. Showing reasonable security safeguards — least privilege, monitoring, logs — matters because penalties for failing to protect data go up to ₹250 crore.
Smaller networks are often flatter, which makes hopping easier. The first 30 days of our plan — LAPS, MFA on admins, separate admin accounts and backups off the domain — mostly configure tools you already license. The Protect bundle starts at ₹398 per user per month, indicative, excluding GST.
No. Bundle prices are sums of the indicative component prices published on the linked XcellHost pages, and the NDR sensor price is a placeholder. All exclude 18% GST and Microsoft or partner licences. You get a written INR quotation after a scoping call.