Exploit unsupported operating systems

Adversaries exploit a specific unpatched vulnerability affecting an unsupported or legacy operating system or service. The required path depends on the flaw: remote SMB/RDP vulnerabilities can yield code execution through an exposed service; local kernel vulnerabilities such as Dirty COW require an existing local account and can elevate privileges. End-of-life status alone does not establish vulnerability; verify the exact OS build, service, and patch state.