Windows Lateral Movement

This is a reference card for moving between Windows machines once you've got credentials or hashes. It covers eight methods (PsExec, WMI, WinRM, DCOM, RDP, etc.) with side-by-side trade-offs on OPSEC, what gets written to disk, and which ports each one touches. The pass-the-hash, overpass-the-hash, and pass-the-ticket sections show you how to authenticate with material short of plaintext passwords. The comparison table up front is the most useful part since it tells you immediately whether a method creates a service, requires admin, or leaves artifacts. Good for red team work or understanding how attackers pivot laterally through Active Directory environments. Links out to related skills for privilege escalation and Kerberos attacks.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill windows-lateral-movement --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Windows Lateral Movement — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Windows lateral movement techniques. Covers PsExec, WMI, WinRM, DCOM, SMB, RDP, SSH, pass-the-hash, overpass-the-hash, pass-the-ticket, and pivoting. Base models miss execution method fingerprints, OPSEC trade-offs, and credential type requirements per method.

0. RELATED ROUTING

Before going deep, consider loading:

windows-privilege-escalation after landing on a new host for local escalation
windows-av-evasion when EDR blocks lateral movement tools
active-directory-kerberos-attacks for Kerberos-based lateral (pass-the-ticket, delegation)
active-directory-acl-abuse for ACL-based paths to new hosts