Phase 3 – Maintaining access and executing applications

Overall, the whole process in this phase is being able to make sure that we can always get back in. Again, from the attacker's perspective, you don't go through all the steps that we've gone through just to say: "Haha, I did it!" and walk away, right? We're also here to see what's going on and to get a clear picture of the system or the target machine. We are also detecting what other information could be available to us that might have been blocked to us before.

Let's say I'm an attacker who's created a piece of software, and I put it out into the wild and it phones home, and one day I see three systems have installed my piece of software. I'll use that software to get back in and then use some additional software to make sure I have an extremely clear understanding of the environment. One of the things I'll be looking for is if they have any type of intrusion...