This timeline is based on a real, anonymized APT simulation at a mid-sized company: roughly 1,500 Active Directory objects, EDR deployed across all endpoints, a 8x5 SOC. The mission objective was narrow: proven data exfiltration from the HR file server. No zero-day, no exotic tooling – 36 hours from the first phishing mail to domain takeover.
-
Hour 0
Initial access (T1566, T1078)
A phishing mail disguised as an internal notification leads to a cloned login page. The user types valid credentials; the MFA prompt is passed through rather than enforced because the login arrives from a device recognized as managed. From the SOC's view, an ordinary morning login.
-
Hour 2
Foothold (T1059, T1105)
On the laptop, a small implant launched from memory establishes the session; nothing touches disk. The EDR agent runs in pass-through mode on this device – it had been placed on an exception list during onboarding. The first chance to stop the operation went unused.
-
Hour 6
Discovery (T1069, T1087)
Recon almost entirely via built-in tools: sessions, shares, host listings. Plus a single signed enumeration binary dropped locally. No alert.
-
Hour 12
Kerberoasting (T1558.003)
Service-account tickets are pulled and cracked offline. One falls within minutes: 22 characters, but built from the company name plus the year. Service-account passwords are among the least rotated secrets in AD estates.
-
Hour 18
Lateral movement (T1021.001)
The service account is local admin on two app servers. The move happens over RDP. From there: tickets in memory, a share of configuration files, a backup job exposing a service-password candidate. Segmentation between the client, application, and management tiers exists on paper only.
-
Hour 26
Escalation (T1098, T1003.006)
A forgotten delegation lets the service account manage groups in one OU. The implant's computer account is written into a privileged operational group; after replication, DCSync through the new account. Domain admin.
-
Hour 36
Mission (T1041)
From the domain admin position the path to the HR file server is straight: 1.4 GB are staged and exfiltrated over HTTPS inside a 90-minute overnight window, disguised as backup traffic.
Reviewed afterwards with the blue team: five of the seven steps were alertable with the infrastructure already installed – anomalous Kerberos consumption, new members in privileged groups, DCSync rights appearing overnight, the EDR exception list, in-memory session behavior. It was identity and configuration paths combined with missing detection. No zero-day, no exotic exploit.
The report carried the complete timeline with all indicators of compromise and prioritized recommendations for logging, hardening, and detection engineering. The takeaway rhymes with everything we write about post-exploitation: control does not end at access, it ends at detection.
Professional European Security Boutique for Elite Penetration Testing, Red Teaming & Exploit Development.