Methods of post-exploitation
Post-exploitation is a crucial step in the attack process. It occurs when an adversary has successfully gained access to the target system and wishes to maintain access, escalate privileges, or gather necessary information. This involves performing actions to bypass detection and maintain persistence, enabling threat actors to continue their activities on the system and the victim’s infrastructure.
There are various techniques that can be applied by threat actors to reach their goals at this stage. Boot or Logon Autostart Execution (T1547) and Initialization Scripts (T1037), Event Triggered Execution (T1546), Scheduled Task/Job (T1053), or Valid Accounts (T1078) might be used to get persistence or escalate privileges. In many cases, in the initial stages of attack, such actions can be performed automatically. Abuse Elevation Control Mechanism (T1548), Domain or Tenant Policy Modification (T1484), Hijack Execution Flow (T1574), and Process Injection...
