What do attackers do after initial access?

Initial access is only a starting position. From there attackers typically orient themselves (discovery), harvest credentials, escalate privileges, set up command and control, establish persistence, avoid detection, move laterally, and finally collect data or cause impact. This phase is often called post-exploitation. Discovery repeats after each new credential or privilege, so the process behaves like a loop rather than a straight line.

What is the cyber attack lifecycle?

The cyber attack lifecycle is the sequence of stages an intrusion passes through, from the first foothold to the attacker's objective. In practice the stages overlap and repeat. Frameworks such asMITRE ATT&CK describe them as tactics rather than a strict order.

What are common privilege escalation techniques?

Usually mundane ones: accounts with more permissions than intended, services running as SYSTEM with a writable binary path, sudo rules that can be turned into a shell, outdated software with a known CVE, and privileged credentials left in scripts a lower-privileged user can read.

What are living off the land attacks?

Attacks in which the intruder uses tools already present and trusted on the system, such as certutil, rundll32, regsvr32 and PowerShell, instead of dropping recognizable malware. Because these are administrative tools, detection depends on whether the behavior is normal for that account and host, not on whether a file is malicious.

How can defenders detect lateral movement?

Lateral movement is a chain of logons, so it has to be viewed as a chain rather than as individual events. Watch Kerberos activity on domain controllers (events 4768 and 4769), logons from hosts an account has never used, and service credentials appearing in interactive sessions. Segmentation, least privilege and MFA on internal access limit what one foothold can reach, and adversarial testing measures how long defenders take to notice (how often to run it).

How do attackers keep access without malware?

By adding a second legitimate way in: an extra access key on an existing AWS IAM user, a new client secret or authentication method in Entra ID, or a new or quietly added privileged account on-prem. Nothing is written to disk, so cleanup has to include rotating credentials, not only reimaging the infected host.

Mykhailo Momot, Author at CodeIT

Home Blog Mykhailo Momot

Mykhailo Momot

Full Stack Engineer

As a Full Stack Engineer at CodeIT, Mykhailo bridges robust backend engineering with modern frontend technologies. Bringing 5+ years of hands-on experience across Node.js, PHP, and Angular, he routinely drives complex third-party integrations and system refactoring. Mykhailo is committed to code quality, automated testing, and creating seamless digital experiences.

What Attackers Do After Initial Access
Initial access is only the starting line. Here’s what attackers do next (discovery, credential theft, privilege escalation, C2, persistence, lateral movement) and where defenders can spot them at each stage of the cyber attack lifecycle.

Mykhailo Momot
Oct 15, 2026
What Attackers Do After Initial Access
Penetration Testing Frequency
Most organizations should treat annual penetration testing as a floor, not a schedule — testing continuously at the infrastructure level, on every meaningful change at the application level, and on a fixed cadence only for independent adversarial assessment. PCI DSS 4.0 already requires this (11.4.2, 11.4.3): annual testing and testing after significant change. Most programs…

Mykhailo Momot
Oct 06, 2026
Penetration Testing Frequency

Business FirstCode NextLet’s talk

What Attackers Do After Initial Access

Penetration Testing Frequency

Business First
Code Next
Let’s talk