After 150+ pentests and thousands of hours inside internal networks, I’ve realized that after an employee or endpoint is compromised, post-compromise risk comes down to three questions.
These three questions form a framework I created to help think through these risks.
It’s called PAC, which stands for Privileges, Access, and Control.
Privileges - What can they do?
Start with what rights and permissions does the compromised identity already have?
Things to consider:
Local administrator rights
AD group memberships
Delegated AD permissions
Entra/Cloud roles
File/share permissions
Application privileges
Keep in mind that what seems benign to you may not be so for a threat actor. Remember they are trying to inflict harm in exchange for money (most of the time).
Access - Where can they go?
What systems, services, data, networks, applications, and identities can the attacker reach from that starting point?
Think of:
Servers
Workstations
Network segments/VLANs
Administrative interfaces
File shares
Internal applications
Databases
SaaS applications
SharePoint
Document management systems
This is effectively the “blast radius” of the initial compromise.
Control - What can they Control?
What can an attacker ultimately impersonate, manipulate, take ownership of, or otherwise abuse?
Things like:
Another user’s account
An administrator account
Security groups
Group Policies
Logon scripts
Certificate templates
Remote access protocols (WinRM, SMB)
Authentication protocols (LLMNR, NTLM)
This is where the first two parts of the framework (Privileges & Access) are combined into post-exploitation compromise.
A real life example starting from a compromised user on a domain joined windows computer:
The threat actor dumped the SAM database (Domain Users were in local admins
The password was sprayed against all hosts and found the local admin password was being reused on multiple servers
The threat actor logged into to the server as a local admin via RDP
The threat actor abused a scheduled task running as a Domain Admin, to add the original compromised user to Domain Admins. (No Alert)
The threat actor performed a DCSync from the original compromised host, stealing all domain credentials and essentially, fully compromised the domain
These issues were discovered over the course of a work week, but only took minutes to fully abuse end-to-end.
This example was not from a threat report.
This is how one of my recent internal pentest engagements went.
Fortunately we found and fixed these issues together with the client before anything bad could happen.
If you’re not sure what would happen in your environment after a user or endpoint becomes compromised, you’d get great value from an internal pentest.
That’s what I do week-in and week-out. If you want help making your environment more secure, book a free discovery call and we’ll talk about how I can help.
Remember these 3 simple questions:
What can they do? —> Where can they go? —> What can they control?
All the best
Spencer
PS - smart IT teams know the goal isn’t to make compromise impossible. It’s to make sure one compromised employee doesn’t become the thing that takes you out.