> For the complete documentation index, see [llms.txt](https://pwc-3.gitbook.io/pwc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pwc-3.gitbook.io/pwc/ji-shu/untitled-1/offensive-security/lateral-movement.md).

# Lateral Movement

Here are the articles in this section:[WinRM for Lateral MovementPowerShell remoting for lateral movement.](https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement)[WinRS for Lateral Movement](https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement)[WMI for Lateral MovementWindows Management Instrumentation for code execution, lateral movement.](https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement)[RDP Hijacking for Lateral Movement with tsconThis lab explores a technique that allows a SYSTEM account to move laterally through the network using RDP without the n...](https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement)[Shared WebrootLateral Movement](https://www.ired.team/offensive-security/lateral-movement/t1051-shared-webroot)[Lateral Movement via DCOMLateral Movement via Distributed Component Object Model](https://www.ired.team/offensive-security/lateral-movement/t1175-distributed-component-object-model)[WMI + MSI Lateral MovementWMI lateral movement with .msi packages](https://www.ired.team/offensive-security/lateral-movement/wmi-+-msi-lateral-movement)[Lateral Movement via Service Configuration Manager](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-abusing-service-configuration-manager)[Lateral Movement via SMB Relaying](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-smb-relaying-by-abusing-lack-of-smb-signing)[WMI + NewScheduledTaskAction Lateral Movement](https://www.ired.team/offensive-security/lateral-movement/wmi-via-newscheduledtask)[WMI + PowerShell Desired State Configuration Lateral MovementLateral Movment, Privilege Escalation](https://www.ired.team/offensive-security/lateral-movement/wmi-+-powershell-desired-state-configuration-lateral-movement)[Simple TCP Relaying with NetCat](https://www.ired.team/offensive-security/lateral-movement/simple-tcp-relaying-with-netcat)[Empire Shells with NetNLTMv2 Relaying](https://www.ired.team/offensive-security/lateral-movement/empire-shells-with-netnltmv2-relaying)[Lateral Movement with Psexec](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-with-psexec)[From Beacon to Interactive RDP SessionLateral Movement, Tunnelling, Firewall Evasion](https://www.ired.team/offensive-security/lateral-movement/from-beacon-to-interactive-remote-desktop-rdp-session)[SSH Tunnelling / Port ForwardingExploring SSH tunneling](https://www.ired.team/offensive-security/lateral-movement/ssh-tunnelling-port-forwarding)[Lateral Movement via WMI Event Subscription](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-wmi-events)[Lateral Movement via DLL Hijacking](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-dll-hijacking)[Lateral Movement over headless RDP with SharpRDP](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-over-headless-rdp-with-sharprdp)[ShadowMove: Lateral Movement by Duplicating Existing Sockets](https://www.ired.team/offensive-security/lateral-movement/shadowmove-lateral-movement-by-stealing-duplicating-existing-connected-sockets)