Summary

Human-operated ransomware attacks are quite complex, so the attack life cycle consists of many stages. Once threat actors have gained an initial foothold, they start post-exploitation to take control over the whole environment.

In this chapter, we have looked at various post-exploitation techniques and reconstructed a part of a ransomware attack based on various forensic artifacts.

We have understood how threat actors gain access to privileged accounts, how they perform network and Active Directory reconnaissance, as well as what techniques they use for lateral movement.

In the next chapter, we'll focus on how ransomware affiliates solve one of the main problems of modern attacks – data exfiltration.