A defender finds evidence that an attacker entered through a weak default account and later accessed other systems. Explain how the attack life cycle can help organize the investigation.

### The concept The life cycle gives investigators a sequence of possible attacker activities to consider. A weak default account can provide a route to initial compromise. After entry, the attacker may establish a foothold, seek higher privileges, learn about connected systems, and move laterally. Finding access to other systems may be evidence that the activity extended beyond the initial point. The model helps organize questions and evidence, but the material does not say that every attacker must perform every stage in exactly the same way. ### What a good answer covers - Connects a weak default account to possible initial compromise. - Considers post-entry activity such as foothold, privilege escalation, and internal reconnaissance. - Identifies access to other systems as possible lateral movement. - Uses the stages to structure investigation without treating them as a guaranteed script. ### Terms - **Foothold**: A continuing position or access within the environment. - **Lateral movement**: Movement from one system or area of an environment to another. ### Remember Use the stages to ask what may have happened next, then test each possibility with evidence.