If an attacker were able to gain access to a user's machine on your network, which of the following actions would she most likely take next?

After an attacker gains initial access to a user's machine, their most critical and immediate objective is to solidify and improve their position. Escalating privileges from a standard user account to an administrative or SYSTEM/root account is the most effective way to achieve this. Gaining elevated privileges allows the attacker to bypass local security controls, install persistent software, access protected data such as credentials from memory (e.g., LSASS), and gain unrestricted ability to perform further actions like internal reconnaissance. While some reconnaissance is possible with low privileges, securing a stable, high-privilege foothold is the tactical priority before expanding operations within the network.

A. Start log scrubbing: This action is used to cover tracks and evade detection. It is typically performed much later in the attack lifecycle, after the primary objectives have been met.
C. Perform port scanning: This is a specific reconnaissance technique. While it is a post-exploitation activity, it is more effectively and stealthily performed after privileges have been escalated to bypass host-based firewalls and use more powerful scanning tools.
D. Initiate reconnaissance: While some local reconnaissance is necessary to find an escalation vector, the primary goal or action is the escalation itself. Gaining full control of the asset (privilege escalation) is the key enabler for all meaningful subsequent actions, including comprehensive network reconnaissance.

1. MITRE ATT&CK® Framework: The ATT&CK Enterprise Matrix outlines adversary tactics. While Discovery (TA0007) and Privilege Escalation (TA0004) are both post-compromise tactics

Privilege Escalation is fundamental to gaining the level of control needed to effectively execute other tactics. Gaining higher-level permissions is a primary step to "break out of a restricted shell or lower-privileged process."

Source: MITRE. (2023). ATT&CK Enterprise Matrix

Tactic TA0004: Privilege Escalation. Retrieved from https://attack.mitre.org/tactics/TA0004/

2. NIST Special Publication 800-115: This guide on security testing describes the typical phases of a penetration test. After gaining initial access ("Vulnerability Exploitation")

the next phase involves escalating privileges to gain administrative access to the system

which then facilitates deeper access into the network.

Source: National Institute of Standards and Technology. (2008). Technical Guide to Information Security Testing and Assessment (NIST SP 800-115). Section 4.3

"Penetration Testing

" describes the phase following initial exploitation as gaining further access

for which privilege escalation is a key technique.

3. University Courseware on Penetration Testing: Methodologies taught in cybersecurity programs emphasize securing access after exploitation. For example

course materials often detail how initial access yields a low-privilege shell

and the immediate next objective is to escalate to a higher-privilege user to control the system before proceeding with network-level discovery.

Source: Georgia Institute of Technology. (n.d.). CS 6265 Information Security Lab

Lab 3: Binary Exploitation. This and similar academic exercises demonstrate the standard attack flow where exploiting a vulnerability leads to a shell

and the subsequent challenge is to escalate privileges to gain root access on the system.