Once inside, attackers look for admin rights and move between systems using legitimate tools. Weak service accounts, reused local admin passwords and flat networks make this step easy.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Remove shared local administrator passwords
- Limit who can log in to servers and domain controllers
- Alert on unusual use of admin tools
Making it stick
Detection at this stage gives you hours or days before encryption. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.