Lateral movement
After the first box, they walk. Credentials, remote admin, and trust you already granted.
Lateral movement is pivoting from the beachhead to other hosts and accounts. Stolen tickets, reused local admin, remote services, and the jump host that became theirs. Segmentation and least privilege shrink the walk. Authentication and admin-protocol logs show it.
Hunt unusual account use, new remote sessions from workstations that should not administer anything, and tools that appear where they are not packaged. Reimaging only the first host leaves them next door.
See also: Persistence, Privileged access management, Network segmentation, Incident response.