Propagation Phase

Done using a mixture of methodologies:

• Credential exploitation.

  • Direct usage or by using allowed applications.

• Impersonating users or applications.

  • Similar to credential exploitations but more advanced based on acquire knowledge (licit behavior).

  • Requires time to learn and mimic licit behavior.

    • Time, applications, and traffic patterns.

• Vulnerability exploitation.

  • Inside a protected domain, systems are many times considered in a secure zone.

  • Less maintained and legacy OS/applications may be required to run (no patching).

  • A broader range of vulnerabilities.