Network and Key Assets Discovery

By this stage, threat actors already have access to one of the hosts in the victim’s infrastructure, have successfully established a foothold on that host, and, if necessary, have escalated their privileges, gained access to authentication data, and bypassed defenses. The natural progression of the attack at this stage is to conduct internal research that will help the attackers understand what infrastructure they are in, what the network topology is, which hosts are present, which of them are joined to a domain, which ones are running specific applications, which versions of operating systems they have installed, what security agents and tooling are used, and much more. The information gathered can not only help threat actors evade defenses or escalate privileges if they have not done so before, but also provide a better understanding of the potential for further attack.

In addition, through internal discovery, attackers can discover key...