Move laterally toward high-value targets (domain controllers, cloud admin accounts, financial systems). - Escalate privileges through identified paths. - Establish additional persistence mechanisms on high-value systems. - Decision Point: If detected, activate contingency plan (go silent or switch t