Persistence and post-exploitation

Authorization first — this is the defender’s map, not a runbook

Everything below describes the post-exploitation lifecycle — what an intruder does once they already have code running — taught so you can detect and disrupt it. There is no attack tooling here, and you don’t need any to understand the mechanism: persistence, lateral movement, and exfiltration are behaviors that leave traces, and the entire point is learning to recognize those traces in your own logs. The only legitimate place to actually exercise these techniques is an authorized engagement with written scope, a CTF, or a lab you built. In MITRE ATT&CK terms, the moment we pick up — code is running on one host — is the handoff from Execution into the long tail of Persistence (TA0003), Lateral Movement, Collection, and Exfiltration. We study the chain so a defender can break it at any link, because breaking it at any one link defeats the whole operation.

The breach is a beachhead, not the objective

The single most common junior misconception about offensive security is that “popping a shell” is the win. It is not — it is the start of the work. A foothold on a single, often low-value host (a build agent, a marketing CMS box, an intern’s laptop) almost never sits where the attacker’s actual objective lives. The objective is the customer database, the signing keys, the cloud admin role, the source repo. The entire post-exploitation phase is the gap between where you landed and what you came for, and it decomposes into a handful of repeating goals: stay (survive a reboot, a logout, a password reset), understand (where am I, what can this account reach), spread (move toward the objective host by reusing what I find), and take (collect and exfiltrate the data) — usually while staying quiet enough to do all of it before anyone notices.

This is why dwell time — the interval between initial compromise and detection — is the metric the whole defensive industry obsesses over. Industry reports have for years measured global median dwell time in the range of roughly one to three weeks, down from many months a decade ago but still vast: weeks is enough to map an entire network, find the crown jewels, and leave. Every day of dwell time is a day the attacker spends in the post-exploitation phase — which means every detection you place in that phase is a chance to cut the operation short long after the initial break-in succeeded.

Persistence: making the foothold survive

The first thing a competent attacker does after gaining execution is buy durability, because their initial access is fragile — a reboot, a crashed process, a rotated password, or a patched vulnerability can evict them at any moment. Persistence is any mechanism that re-establishes code execution automatically, so the attacker doesn’t have to re-exploit the original bug. The defining property of every persistence technique is the same: it hooks a legitimate, automatic execution trigger so the malicious code runs as a side effect of normal system behavior.

The triggers are mundane, which is exactly why they work. A scheduled task or cron job runs the implant every few minutes or every boot. A new or modified service / daemon starts it at system startup. A shell profile or autostart entry runs it at every login. On a compromised cloud or CI environment, persistence often looks even more innocuous: a new deploy key, a service-account token, an extra IAM user or access key, a malicious step quietly added to a pipeline definition — credentials and config that survive every reboot because they’re supposed to. The cloud-native version of “survive a reboot” is “survive being kicked out,” and an added access key does that perfectly: rotate the compromised password and the attacker still walks in through the key you didn’t know existed.

The detection signal is creation and modification of these triggers. A new cron entry, a new systemd unit, a new IAM access key, a new deploy key, a change to a pipeline file — each is a write to a sensitive, rarely-changed surface, and each is a high-signal alert. The defender’s leverage here is that persistence is one of the few attacker actions that must leave a durable artifact behind: the whole point is that something persists, so something is there to find.

Lateral movement: spreading by reuse, not by re-exploiting

Once persistent, the attacker rarely needs another exploit. The dominant technique for reaching the objective is lateral movement by credential reuse: harvest a credential on the host you own — a cached password, a service-account token, an SSH key, a Kubernetes service-account JWT, a cloud access key sitting in an environment variable — and use it to authenticate to the next host as a legitimate user. This is the heart of why a single low-value foothold is so dangerous: networks are full of shared and over-scoped credentials, and one of them on your build agent may be the key to the artifact registry, which holds a key to production.

The mechanism that makes this devastating is trust topology. Most internal networks were built assuming “inside is safe,” so once you’re inside, services authenticate each other with long-lived shared secrets and flat reachability — any host can talk to any other. An attacker treats this as a graph: each compromised credential is an edge to a new node, and they walk the graph from the disposable beachhead toward the high-value target. The defensive counters are structural: network segmentation (so a CI box can’t reach the production database at all), least-privilege scoping (so a stolen token can do one thing, not everything), and short-lived / workload-bound credentials (so a harvested secret is useless minutes later or off its origin host). The detection signal is an authentication that’s normal in isolation but anomalous in context: this identity, from this source, to this destination, at this time, has never happened before. That east-west auth is the tell, because the credential is valid — only the path is new.

Exfiltration: the last and most catchable mile

Collecting the target data is one thing; getting it out is another, and it’s where a careful attacker is most exposed — because data leaving the network is the one action that, by definition, has to cross a boundary you control. The craft of exfiltration is therefore about blending in: rather than open a suspicious connection to an unknown IP and push a 4GB tarball (which any egress monitor would flag instantly), the attacker tunnels the data out over a channel that’s already allowed and already noisy. The classic choices are HTTPS to a benign-looking domain, DNS queries (every network resolves DNS, and the data rides in the subdomain labels), or a trusted SaaS API the org already uses. They throttle the transfer to a trickle and spread it over hours or days, so the volume never spikes above the background.

The detection signal is the statistical shape of egress, not its content (which is encrypted): an unusual volume of outbound data, a new or rare destination, a long-lived low-and-slow connection, or DNS traffic with abnormally high query entropy and volume to one domain. This is why egress filtering and DLP are the last line: a host that should only ever talk to two internal services has no business opening a connection to the open internet, and an allowlist-by-default egress policy turns “blend into allowed traffic” into “there is no allowed traffic to blend into.” The defender’s structural win is the same one that appears at every stage — make the legitimate paths few and explicit, so the anomalous one stands out instead of hiding in a sea of permitted noise.

How a senior reads the post-exploitation chain

The unifying lesson is that detection-in-depth mirrors defense-in-depth: the attacker has to chain many steps, and each one is a separate chance to catch them. A senior doesn’t bet everything on preventing the initial breach — breaches happen — but instruments the after: alert on new persistence artifacts, on anomalous east-west authentication, on reads of secret stores, and on the statistical shape of egress. Equally, a senior shrinks the chain structurally so each remaining step is louder: segmentation removes lateral edges, least privilege shrinks what a stolen credential buys, short-lived credentials expire the loot, and allowlist egress removes the cover that exfiltration hides in. The thing to internalize is that catching the attacker anywhere in the post-exploitation chain defeats the operation — so dwell time isn’t a measure of how good your perimeter is, it’s a measure of how well you watch what happens after it’s already been crossed.