postexploitation

Postexploitation is the phase of a cyber intrusion that begins after an initial foothold has been established on a target system. During this stage, an attacker or tester seeks to maintain access, elevate privileges, and move deeper into the network while minimizing disruption and avoiding detection.

Common goals include persistence (keeping access through reboots or stealthy footholds), privilege escalation, discovery of other machines and data, lateral movement to adjacent systems, credential harvesting, data collection, and preparation for exfiltration or further operations. Activities are often organized into categories such as maintaining control (backdoors, new services, or scheduled tasks), expanding reach (mapping networks and trusts), and evading defenses (obscuring artifacts or communications). The specifics vary with objectives and the environment.

In legitimate contexts such as penetration testing and red teaming, postexploitation is simulated under authorization to assess security controls and incident response capabilities. In real-world intrusions, adversaries use postexploitation techniques to deepen access, maintain stealth, and achieve goals such as data theft, disruption, or ongoing presence.

Defenders focus on detecting and mitigating postexploitation through endpoint detection and response, network monitoring, and rigorous incident response. Key defensive activities include rapid containment, eradication of backdoors, recovery, and post-incident analysis. Many security frameworks, such as MITRE ATT&CK, categorize postexploitation activities into persistence, privilege escalation, discovery, lateral movement, collection, exfiltration, defense evasion, and command and control, as a way to structure defense and assessment efforts.