Lateral Movement in Empire can use which techniques to move to another target?

• A. FTP
• B. PSEXEC/SSH
• C. SNMP
• D. LDAP binding

Answer: (B)

Lateral movement relies on remote execution on other systems once you’ve foothold on one host. PSEXEC and SSH are built for that: they let you run commands or push payloads on another machine over the network, using Windows SMB-based remote execution (PSEXEC) or secure remote access (SSH) to pivot to the next target. This capability directly enables spreading to neighboring hosts without needing to log in manually on each one.

FTP is mainly a file transfer protocol and doesn’t provide a built-in, reliable way to execute code on a remote host to pivot. SNMP handles network management and data gathering, not remote command execution for lateral movement. LDAP binding relates to authenticating to directory services and isn’t a method for remotely executing payloads on other targets.