Post-Exploitation & Lateral Movement

What to do after access, to demonstrate real business impact for the report — mapped to MITRE ATT&CK. In an authorized engagement the goal is to prove what an attacker could reach and document it, not to damage systems or maintain covert access.

0. Authorization & conduct gate

• Post-exploitation and lateral movement are in scope; objectives defined.
• Data-access limits (what you may read/collect) and no-destruction rule.
• Track every change/artifact for cleanup; provide a deconfliction identifier to the SOC.

1. Situational awareness (Discovery)

• Identify the host, privileges, users, processes, and security tooling present.
• Map reachable networks, shares, services, and trust relationships from this position.
• Locate valuable data stores and next-hop targets.

2. Credential access

• Harvest credentials/keys/tokens from memory, files, config, browsers, and credential stores (authorized).
• Assess reuse potential across hosts, services, and cloud (→ active-directory-pentest, entra-cloud-pentest).
• Detection signal: credential-dumping and unusual token use — verify the blue team sees it.

3. Lateral movement

• Move using harvested credentials/keys via legitimate protocols (remote services, admin protocols) rather than noisy exploits where possible.
• Document each hop as an attack-path edge (feeds vuln-chaining).
• Fix themes: network segmentation, least privilege, MFA on admin access, monitoring of remote-exec and unusual auth.

4. Collection & objective completion

• Reach the agreed objective (specific data, system, or "domain/cloud dominance") and capture proof (screenshots/hashes/redacted samples) — collect the minimum needed to demonstrate impact.

5. Exfiltration & impact (simulate, don't harm)

• Demonstrate an exfiltration path with benign/synthetic data or a small redacted sample per RoE; do not remove real sensitive data.
• Never execute destructive "impact" techniques (ransomware/wiping) against real systems.

6. Persistence (understand for detection; avoid lasting)

Understand persistence techniques to advise detection, but in engagements prove capability and remove any artifacts. Provide defenders detection guidance instead.

7. Cleanup & deconfliction

• Remove created accounts/files/artifacts; provide a full timeline of actions and touched systems for the blue team.

8. Reporting

Present the end-to-end attack path, the business impact reached, detection opportunities at each step, and prioritized fixes that break the path. Route path analysis to vuln-chaining. Checklist: references/postex-checklist.md.

<sub>© 2026 noahfranklin · Part of the Gideon security suite · MIT License · Original work.</sub>