TTP 2: Protocol Abuse. Thus occurs after TTP one of getting on your internal network.