Post-Exploitation and Lateral Movement · Topic 4 of 5
Documentation and Attack Narratives
Document a penetration test as you go, write an attack narrative with MITRE ATT&CK mapping, and turn evidence into prioritised remediation advice.
- 5 min
- Keep notes during testing, with times, sources, targets, actions and results.
- A narrative is an ordered story of the attack path from start to impact.
- Map steps to MITRE ATT&CK tactics and techniques for a common language.
What it is
Documentation is the running record a tester keeps during the engagement. From that record, the tester writes an attack narrative: a clear story of how access was gained, extended and used, and what it means for the client.
Narrative and remediation advice are what make findings useful. A list of unrelated vulnerabilities is easy to ignore, but a chain that ends at the customer database is hard to ignore.
How it works
Keeping good notes
Testers record as they work, not afterward. Notes made later are less accurate and often miss details.
| Record | Why |
|---|---|
| Time and date, in a consistent time zone | Lets the client match activity with logs |
| Source address and tool used | Separates test activity from real attacks |
| Target host, account or application | Shows the scope was respected |
| Action taken and result | Allows others to reproduce the finding |
| Screenshots and output excerpts | Evidence of impact |
| File hashes for any evidence files | Shows that the evidence was not changed |
| Changes made to systems | Feeds cleanup |
Sensitive values, such as passwords and personal data, should be masked in the report. Original evidence is stored securely and kept only as long as the agreement allows.
The attack narrative
The narrative explains how individual weaknesses combined. It is told in order, from the first step to the final impact.
An effective narrative has these parts.
- Starting point: where the tester began, such as the internet or a user account.
- Steps: each action in plain words, with the weakness that allowed it.
- Decisions: why a path was chosen, and what else was tried.
- Outcome: the highest access reached or the data proven reachable.
- Detection: whether the client's tools or staff noticed, and when.
For example, a narrative might read: an exposed web application leaked a service credential, the credential worked on an internal server, and a stored administrator session on that server gave access to the domain. This shows the client how three modest findings add up to a serious path.
Mapping to frameworks
Linking steps to the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework gives the client a shared language. Each step is labelled with a tactic (the goal, such as Initial Access, Persistence or Lateral Movement) and a technique (the method).
This helps defenders check whether they have detection for each technique. It also lets them compare results across tests.
Findings can also be linked to Common Weakness Enumeration (CWE) entries and Common Vulnerabilities and Exposures (CVE) identifiers so that technical teams can research fixes.
Evidence handling
Evidence should be accurate, complete and protected.
- Keep the original and a working copy.
- Record hashes, such as SHA-256, of important files.
- Note who handled the evidence and when (a simple chain of custody).
- Encrypt stored evidence and limit access.
Remediation recommendations
Every important finding needs a fix that the client can act on. Good advice is specific, ordered by priority and realistic for the client's resources.
| Advice quality | Example |
|---|---|
| Weak | Improve password security |
| Strong | Enforce a minimum 14 character passphrase policy, enable multifactor authentication (MFA) for remote access, and rotate the exposed service account password this week |
Remediation is best grouped by the point at which it breaks the attack path.
| Level | Example |
|---|---|
| Immediate | Rotate exposed credentials, patch an exposed service |
| Structural | Segment the network, remove local administrator password reuse |
| Detection | Alert on unusual internal logons |
| Process | Improve patch management and secure development |
Fixing the first link of a chain can stop the entire path, but defence in depth recommends fixing more than one.
Positive observations
The documentation should also note what worked. For example, an alert that fired within minutes or a control that blocked an attempt shows the client what to keep.
When two answers both describe a good remediation, choose the one that fixes the root cause and is specific, rather than the one that only treats a symptom.
What to remember for the exam
- Keep notes during testing, with times, sources, targets, actions and results.
- A narrative is an ordered story of the attack path from start to impact.
- Map steps to MITRE ATT&CK tactics and techniques for a common language.
- Hash evidence files, protect them and record who handled them.
- Mask sensitive data such as passwords in the report.
- Remediation advice must be specific, prioritised and realistic.
- Breaking one link in the chain can stop the path, but layered fixes are better.
- Include detection results and positive findings, not only failures.
Common mistakes
Writing notes at the end. Details and timestamps are lost, and the client cannot match them to logs.
Listing findings without a story. Readers miss how the weaknesses combine.
Including live secrets in the report. A report with real passwords becomes a security risk itself.
Giving vague remediation. The client cannot act on "harden systems".
Confusing ATT&CK tactic with technique. A tactic is the goal, and a technique is how it is achieved.
Check yourself
What is an attack narrative?
An ordered story showing how weaknesses were combined from the starting point to the final impact.
Why record hashes of evidence files?
To show later that the evidence has not been changed.
What is the difference between an ATT&CK tactic and a technique?
A tactic is the attacker's goal, and a technique is the method used to reach it.
Topic 4 of 5 in Post-Exploitation and Lateral Movement
Test yourself on Post-Exploitation and Lateral Movement
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.