Follow-on activity is everything an attacker does after the first successful compromise. Instead of stopping at access, the operator uses the foothold to stay resident, expand privileges, prepare new tooling, move laterally, or set up covert communications. In practice, this can include dropping modular malware, creating persistence mechanisms, staging data for theft, or changing network paths so later commands are harder to detect.
This matters because the initial intrusion is often only the entry point. Defenders who focus only on the original exploit may miss the quieter second phase where real control is built. Hunting for follow-on activity means looking for unusual process chains, unexpected outbound connections, new services or scheduled tasks, and signs that a host has become a staging area for later steps. In a post-compromise framework, follow-on activity is the point where access turns into sustained operations.