After a phishing click, how do attackers get from one laptop to the rest of the network?

Usually in a few predictable steps. The malicious file or link gives them a remote-control channel back to their own server, which shows up as regular outbound connections. They then look around: which servers, shares and accounts exist, often by scanning the internal network or querying the directory. Next they collect more credentials, from the laptop's memory, saved browser passwords or other systems, and use them to log in to other machines with normal admin tools such as remote desktop, remote PowerShell or file shares. From there they aim for the domain controller, the backups and the data stores. Each step leaves a network trace: new connections between internal machines that rarely talk, scanning, admin protocols coming from an ordinary laptop, and data moving to unusual places. Those traces are what network detection and response (NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.) watches for, and why a phishing click does not have to end in a full breach.

← All 29 questions on Phishing and e-mail aftermathAll topics