Understands and can perform common post exploitation activities, including: • Obtaining password hashes, both from the local SAM and cached credentials • Obtaining locally stored clear-text passwords • Cracking password hashes • Obtaining patch levels• deriving a list of missing security patches • Reverting to a previous state • Lateral and horizontal movement