Post-Exploitation, Persistence, and Covering Tracks
This domain covers what happens after initial access: expanding access, maintaining persistence, moving laterally, and removing artifacts. The exam tests restraint, scope control, and evidence handling as much as technique.
Core rules and concepts
- Post-exploitation begins with situational awareness: whoami, hostname, network interfaces, routes, shares, trusts, and security controls. Map only what the engagement covers.
- Lateral movement uses stolen credentials, hashes, tickets, or trust relationships. Pivoting routes traffic through a compromised host; document every hop.
- Persistence mechanisms include scheduled tasks, services, startup items, SSH keys, web shells, and cron jobs. Each must be approved, documented, and removable.
- Covering tracks is not a license to destroy evidence. Cleanup should remove only artifacts you created, preserve logs, and follow the data-retention agreement.
Worked example
After compromising a workstation, you find an internal subnet not listed in scope. You do not scan it. You record the route, notify the client contact, and request a scope amendment. If approved, you pivot with a logged tunnel and limit testing to the named hosts. The reasoning: a route is a discovery, but sending traffic into a new subnet is a scope change.
Traps
Do not install persistence you cannot remove. Do not clear event logs or alter timestamps; that is anti-forensics and can invalidate the report. Avoid exfiltrating real customer data when a small sample or hash proves access. Never assume domain admin is the goal; the goal is the agreed objective.