I read the following tweet by Florian Roth a couple of days ago:

People frequently ask me about process hollowing/doppelgänging, spectre/meltdown, skeleton keys & attack vectors involving liquid nitrogen.
Recently I replied:
Would you notice someone running “whoami” on one of your servers? https://t.co/Y4e8YaFdtt

— Florian Roth (@cyb3rops) January 27, 2018

I could not agree more with the reply from Florian. See below a list of resources that help tuning detection mechanisms for post exploitation activities.

1. Windows enumeration commands 
2. Windows post exploitation resources
3. Living off the land
4. Windows commands abused by the attackers
5. Post Exploitation using WMIC
6. Post Exploitation in Windows using dir Command
7. Post Exploitation on Windows PC
8. Linux post exploitation
9. Patterns of behaviour

Enjoy and happy hunting ;)