Assume the network is already penetrated, and the attacker already fully controls another PC.
Other than setting up a proxy to intercept traffic from all other systems on the network and use that to inject rogue traffic. Other than that, what would the vectors be for an attacker to attempt to directly infiltrate one of the computers on this network. More importantly, what would the corresponding mitigation steps be?
The purpose of this question is mainly educational/theoretical. So mitigation steps required (however few there are) other than "installing an AV" are preferred.
All attacks would be through the network. There is no transfer of physical media between the infected computer and the (to-be-)protected one. You can further assume that there is no shared storage (NAS, etc), nor are there any shared folders, shared credentials (user-groups), RDP/VNC etc on ANY of the computers.
However, other than the above, no further hardening steps have been taken.
The primary concern is data-theft. (in case that matters, or if it can help narrow down the scope of the question)
This question is intentionally limited to Windows 7 so as to limit the scope of the answers, and to provide some further limiting, pre-existing conditions (folder-sharing and RDP disabled). However if the essential nature of in-network PC-to-PC threats do not vary much, then a platform-neutral answer will also be appreciated.
If the question is still too broad, I'd appreciate being pointed in the direction of an informative (if technical) guide, or even a starting point for getting such (technical / detailed) guides.