Post Exploitation

---
name: post-exploitation
description: "Use after gaining access during an authorized engagement to demonstrate impact — situational awareness, credential access, lateral movement, and reaching objectives — while documenting the path. Covers methodology mapped to MITRE ATT&CK (Discovery, Credential Access, Lateral Movement, Collection, Exfiltration, Impact) with detection signals for the blue team. Authorized engagements only; prove and document rather than cause harm."
---

# Post-Exploitation & Lateral Movement

What to do after access, to demonstrate real business impact for the report — mapped to **MITRE ATT&CK**. In an authorized engagement the goal is to *prove* what an attacker could reach and *document* it, not to damage systems or maintain covert access.

## 0. Authorization & conduct gate
- [ ] Post-exploitation and lateral movement are in scope; objectives defined.
- [ ] Data-access limits (what you may read/collect) and no-destruction rule.
- [ ] Track every change/artifact for cleanup; provide a deconfliction identifier to the SOC.

## 1. Situational awareness (Discovery)
- Identify the host, privileges, users, processes, and security tooling present.
- Map reachable networks, shares, services, and trust relationships from this position.
- Locate valuable data stores and next-hop targets.

## 2. Credential access
- Harvest credentials/keys/tokens from memory, files, config, browsers, and credential stores (authorized).
- Assess reuse potential across hosts, services, and cloud (→ `active-directory-pentest`, `entra-cloud-pentest`).
- **Detection signal:** credential-dumping and unusual token use — verify the blue team sees it.

## 3. Lateral movement
- Move using harvested credentials/keys via legitimate protocols (remote services, admin protocols) rather than noisy exploits where possible.
- Document each hop as an attack-path edge (feeds `vuln-chaining`).
- **Fix themes:** network segmentation, least privilege, MFA on admin access, monitoring of remote-exec and unusual auth.

## 4. Collection & objective completion
- Reach the agreed objective (specific data, system, or "domain/cloud dominance") and capture proof (screenshots/hashes/redacted samples) — **collect the minimum needed** to demonstrate impact.

## 5. Exfiltration & impact (simulate, don't harm)
- Demonstrate an exfiltration *path* with benign/synthetic data or a small redacted sample per RoE; do not remove real sensitive data.
- Never execute destructive "impact" techniques (ransomware/wiping) against real systems.

## 6. Persistence (understand for detection; avoid lasting)
Understand persistence techniques to advise detection, but in engagements prove capability and remove any artifacts. Provide defenders detection guidance instead.

## 7. Cleanup & deconfliction
- Remove created accounts/files/artifacts; provide a full timeline of actions and touched systems for the blue team.

## 8. Reporting
Present the end-to-end attack path, the business impact reached, detection opportunities at each step, and prioritized fixes that break the path. Route path analysis to `vuln-chaining`. Checklist: `references/postex-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>