# Lateral Movement

- [WinRM for Lateral Movement](/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement.md): PowerShell remoting for lateral movement.
- [WinRS for Lateral Movement](/offensive-security/lateral-movement/winrs-for-lateral-movement.md)
- [WMI for Lateral Movement](/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement.md): Windows Management Instrumentation for code execution, lateral movement.
- [RDP Hijacking for Lateral Movement with tscon](/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement.md): This lab explores a technique that allows a SYSTEM account to move laterally through the network using RDP without the need for credentials.
- [Shared Webroot](/offensive-security/lateral-movement/t1051-shared-webroot.md): Lateral Movement
- [Lateral Movement via DCOM](/offensive-security/lateral-movement/t1175-distributed-component-object-model.md): Lateral Movement via Distributed Component Object Model
- [WMI + MSI Lateral Movement](/offensive-security/lateral-movement/wmi-+-msi-lateral-movement.md): WMI lateral movement with .msi packages
- [Lateral Movement via Service Configuration Manager](/offensive-security/lateral-movement/lateral-movement-abusing-service-configuration-manager.md)
- [Lateral Movement via SMB Relaying](/offensive-security/lateral-movement/lateral-movement-via-smb-relaying-by-abusing-lack-of-smb-signing.md)
- [WMI + NewScheduledTaskAction Lateral Movement](/offensive-security/lateral-movement/wmi-via-newscheduledtask.md)
- [WMI + PowerShell Desired State Configuration Lateral Movement](/offensive-security/lateral-movement/wmi-+-powershell-desired-state-configuration-lateral-movement.md): Lateral Movment, Privilege Escalation
- [Simple TCP Relaying with NetCat](/offensive-security/lateral-movement/simple-tcp-relaying-with-netcat.md)
- [Empire Shells with NetNLTMv2 Relaying](/offensive-security/lateral-movement/empire-shells-with-netnltmv2-relaying.md)
- [Lateral Movement with Psexec](/offensive-security/lateral-movement/lateral-movement-with-psexec.md)
- [From Beacon to Interactive RDP Session](/offensive-security/lateral-movement/from-beacon-to-interactive-remote-desktop-rdp-session.md): Lateral Movement, Tunnelling, Firewall Evasion
- [SSH Tunnelling / Port Forwarding](/offensive-security/lateral-movement/ssh-tunnelling-port-forwarding.md): Exploring SSH tunneling
- [Lateral Movement via WMI Event Subscription](/offensive-security/lateral-movement/lateral-movement-via-wmi-events.md)
- [Lateral Movement via DLL Hijacking](/offensive-security/lateral-movement/lateral-movement-via-dll-hijacking.md)
- [Lateral Movement over headless RDP with SharpRDP](/offensive-security/lateral-movement/lateral-movement-over-headless-rdp-with-sharprdp.md)
- [Man-in-the-Browser via Chrome Extension](/offensive-security/lateral-movement/man-in-the-browser-via-chrome-extension.md)
- [ShadowMove: Lateral Movement by Duplicating Existing Sockets](/offensive-security/lateral-movement/shadowmove-lateral-movement-by-stealing-duplicating-existing-connected-sockets.md)