Summary

Once threat actors have gained initial access to the host in the victim’s infrastructure and have successfully established a foothold in it, the next important step in the development of the attack is to explore the network and key assets.

Depending on the motivation and goals of threat actors, the data they attempt to extract may vary, as may the methods used. For ransomware operators, the priority is to use off-the-shelf tools to quickly collect data on available hosts, domain controllers, and backup servers, which will be most critical to the victim and will allow the attackers to more likely receive a ransom for decryption. At the same time, groups conducting espionage attacks are likely to try to operate covertly, gradually extracting data of interest using system utilities and self-written scripts.

The discovery process itself is inextricably linked to other techniques used by adversaries. Thus, the data collected during the discovery process can influence...