progression of cyber attack basics

Are there any useful articles you can suggest for research purposes to gain a better understanding as to how a security attack (involving actual bad actors/human beings as opposed to malware) “progresses” after an initial base position has been achieved within a private network environment.
For arguments sake to provide a scenario, if a malicious insider had intentions to compromise as much sensitive data, or cause as much disorder to affect the company as possible, and they had managed to through whatever means gain unauthorized admin rights on an innocuous windows member server hosting no sensitive data joined to a local AD, what would b the general next steps they would take from that position to attempt to compromise other systems in the same environment? I am not entirely sure what the ‘progression’ of an attack would be referred to in the pen-testing/hacking community in order to research further myself, so that would be interesting also. By progression, I mean to development of an attack moving gradually towards the end goal of compromising as much/if not every system in the domain.