After the Foothold: Movement and Escalation

Initial access gets you one machine belonging to one person. Everything that matters happens next, and it is usually faster than the organisation expects.

What the first hour looks like

Not exploitation — orientation. What domain is this, what tooling is watching, what does this user have access to, where does the interesting data live, and which accounts administer it.

Much of that comes from ordinary directory queries a normal user is permitted to make. That is worth sitting with: a large part of internal reconnaissance is indistinguishable from legitimate activity, which is precisely why detecting it is hard.

The four things that make it quick

Different estates, same short list.

• Local administrator password reuse. One password shared across every workstation turns a single machine into all of them. The fix is per-machine randomised passwords, it is well understood, and it is still missing more often than not.
• Over-privileged service accounts. Accounts with rights nobody has reviewed since the application was installed, frequently with passwords that never expire and are recoverable offline.
• Credentials lying around. In scripts, in scheduled tasks, in spreadsheets on shared drives, in configuration files. Reconnaissance finds these faster than any exploit.
• Flat internal networks. Where reaching one segment means reaching all of them, initial access and objective are nearly the same event.

None of these is exotic, and none is what security budgets are usually spent on.

Staying quiet

A red team's constraint is not capability but noise. Anything loud gets caught, and getting caught ends the route.

So the tradecraft is about blending: using tools already present on the machine rather than introducing new ones, working within business hours, communicating over protocols that already carry traffic. This is the part that distinguishes a red team from a penetration test — a penetration test does not care whether it is noticed.

Why this is the phase worth detecting

Initial access will eventually succeed against anyone. Someone will click something, a credential will leak, an edge appliance will have a bad month. Treating prevention of initial access as the whole strategy assumes a perfect record forever.

Movement is different. It takes time, it touches many systems, and it leaves traces across all of them. It is the phase where a competent defender has the most opportunity to notice — which is why the detection timeline in the report matters more than the account of how the team got in.

What that looks like from the defender's chair is in what the exercise tells you about detection.