Windows Lateral Movement

This is a reference card for moving between Windows machines once you've got credentials or hashes. It covers eight methods (PsExec, WMI, WinRM, DCOM, RDP, etc.) with side-by-side trade-offs on OPSEC, what gets written to disk, and which ports each one touches. The pass-the-hash, overpass-the-hash, and pass-the-ticket sections show you how to authenticate with material short of plaintext passwords. The comparison table up front is the most useful part since it tells you immediately whether a method creates a service, requires admin, or leaves artifacts. Good for red team work or understanding how attackers pivot laterally through Active Directory environments. Links out to related skills for privilege escalation and Kerberos attacks.

Install to Claude Code

npx -y skills add yaklang/hack-skills --skill windows-lateral-movement --agent claude-code