Procedure examples

Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.

BlackByte used tools such as Arp to identify remotely-connected devices.

GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.

APT3 has a tool that can detect the existence of remote systems.

Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.

APT41 has used MiPing to discover active systems in the victim network.

Dragonfly has likely obtained a list of hosts in the victim environment.

menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.

APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.

HAFNIUM has enumerated domain controllers using `net group "Domain computers"` and `nltest /dclist`.

Naikon has used a netbios scanner for remote machine identification.

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.

Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.

Mustang Panda has queried Active Directory for computers using AdFind. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.

Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.

Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.

APT39 has used NBTscan and custom tools to discover remote systems.

Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.

Ke3chang has used network scanning and enumeration tools, including Ping.

Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.

FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.

Lotus Blossom has used Ping to identify remote systems.

Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.

MirrorFace has used Ping for system discovery.

Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network.

BRONZE BUTLER typically use ping and Net to enumerate systems.

Deep Panda has used ping to identify other machines of interest.

Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.

ToddyCat has used `ping %REMOTE_HOST%` for post exploit discovery.

Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.

Fox Kitten has used Angry IP Scanner to detect remote systems.

Earth Lusca used the command powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -
property * | findstr “Address”” to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.

Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.

Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.

Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.

HEXANE has used `net view` to enumerate domain machines.

Magic Hound has used Ping for discovery on targeted networks.

Threat Group-3390 has used the net view command.

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

ShinyHunters has enumerated the internal subnet using ` cat /etc/hosts | grep -E "[redacted_victim_string]"`.