Moving laterally

Before they start to move laterally, the threat actors need to collect information about the network they have got into. Such activities may include network scanning and Active Directory reconnaissance.

The two most common network scanning tools that are leveraged by various ransomware affiliates are Advanced IP Scanner and SoftPerfect Network Scanner.

As for Active Directory reconnaissance, one of the most common tools that's leveraged by threat actors is AdFind, a legitimate command-line Active Directory query tool.

Here's an example of how this tool was used by Netwalker ransomware affiliates:

adfind.exe -f "(objectcategory=person)" > ad_users.txt
adfind.exe -f "objectcategory=computer" > ad_computers.txt
adfind.exe -sc trustdmp > trustdmp.txt
adfind.exe -subnets -f (objectCategory=subnet)> subnets.txt
adfind.exe -gcb -sc trustdmp > trustdmp.txt
adfind.exe -sc domainlist > domainlist.txt
adfind.exe -sc...