Post Exploitation

Ask review

Assess impact, test lateral movement, evaluate data exposure, and document access chains

Hats
2
Review
Ask
Unit Types
Lateral Movement, Privilege Escalation, Data Exposure
Inputs
Exploitation

Dependencies

Exploitationaccess-log

Hat Sequence

1

Impact Assessor

Focus: Evaluate the business impact of each successful access chain. Classify data exposure by sensitivity, assess regulatory implications, estimate blast radius, and determine the real-world consequences if each vulnerability were exploited by a malicious actor.

Produces: Impact assessment with business risk ratings, data classification of exposed assets, regulatory implications (GDPR, HIPAA, PCI-DSS, etc.), and worst-case scenario analysis for each access chain.

Reads: Post-exploit analyst's attack graph, access log, original scope and rules of engagement.

Anti-patterns:

  • Inflating or deflating severity to fit a predetermined narrative
  • Ignoring regulatory or compliance implications of data exposure
  • Assessing technical impact without translating to business risk
  • Failing to distinguish between demonstrated impact and theoretical impact
  • Not considering the cumulative effect of chained vulnerabilities
  • Treating all data exposure as equivalent regardless of data classification
2

Post Exploit Analyst

Focus: From established footholds, map lateral movement possibilities, identify privilege escalation paths, and assess what an attacker could reach from each compromised position. Document the full attack graph without causing additional harm.

Produces: Attack graph documenting lateral movement paths, privilege escalation chains, credential exposure, and network segments reachable from each foothold.

Reads: Access log from exploitation, service inventory, network map.

Anti-patterns:

  • Actually exfiltrating sensitive data instead of documenting its accessibility
  • Attempting lateral movement outside the authorized scope
  • Installing persistent backdoors or modifying system configurations
  • Failing to document the exact path taken at each step for reproducibility
  • Not cleaning up artifacts (shells, temporary files) created during analysis
  • Causing service disruption while exploring post-exploitation paths

Post-Exploitation

Criteria Guidance

Good criteria examples:

  • "Impact assessment documents the maximum access level achieved, data categories exposed, and blast radius of each access chain"
  • "Lateral movement analysis maps at least 3 potential pivot paths with the credentials or access required for each"
  • "Privilege escalation findings document the starting access level, technique used, and resulting access level with evidence"

Bad criteria examples:

  • "Impact is assessed"
  • "Lateral movement tested"
  • "Data exposure documented"

Completion Signal

Impact assessment exists documenting the full scope of what an attacker could achieve through each access chain. Lateral movement paths are mapped with required credentials and access levels. Data exposure analysis categorizes accessible data by sensitivity. Privilege escalation paths are documented end-to-end. All post-exploitation activity stayed within scope and no data was exfiltrated or destroyed.