Procedure examples

KV Botnet Activity gathers victim IP information during initial installation stages.

During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.

During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.

During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network.

During ShadowRay, threat actors invoked DNS queries from targeted machines to identify their IP addresses.

During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.

During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.

During Operation AkaiRyū, MirrorFace used Arp and `dir` for discovery in compromised environments.

During FunnyDream, the threat actors used ipconfig for discovery on remote systems.

During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.

During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing `arp -a` and `nslookup` commands.

During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.

During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.

During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.

During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.

During APT28 Nearest Neighbor Campaign, APT28 collected information on wireless interfaces within range of a compromised system.

During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.

During Operation Digital Eye, threat actors used Ping for reconnaissance.

During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.

During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.

During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.

During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.

During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.

During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.

Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions.

During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.

During Salesforce Data Exfiltration, threat actors used API queries to automatically exfiltrate large volumes of data.

ArcaneDoor included scripted exfiltration of collected data.

During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.

During C0018, the threat actors opened a variety of ports to establish RDP connections, including ports 28035, 32467, 41578, and 46892.

During Operation Digital Eye, threat actors moved laterally using RDP.

During C0015, the threat actors used RDP to access specific network hosts of interest.

During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.

During the C0032 campaign, TEMP.Veles utilized RDP throughout an operation.

During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.

During APT28 Nearest Neighbor Campaign, APT28 used RDP for lateral movement.

During the 2025 Poland Wiper Attacks, adversaries utilized RDP to log into jump hosts and then moved laterally to other victim devices to include a domain controller.

During Operation MidnightEclipse, threat actors used SMB to pivot internally in victim networks.

During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.

During HomeLand Justice, threat actors used SMB for lateral movement.

During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.

During APT28 Nearest Neighbor Campaign, APT28 leveraged SMB to transfer files and move laterally.

During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized `net use` to connect to network shares.

During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.

Leviathan used remote shares to move laterally through victim networks during Leviathan Australian Intrusions.

During Cutting Edge, threat actors used SSH for lateral movement.

During the C0032 campaign, TEMP.Veles relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.

Leviathan used SSH brute force techniques to move laterally within victim environments during Leviathan Australian Intrusions.

During Operation MidnightEclipse, threat actors used WinRM to move laterally in targeted networks.

During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.