Procedure examples

KV Botnet Activity gathers victim IP information during initial installation stages.

During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.

During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.

During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network.

During ShadowRay, threat actors invoked DNS queries from targeted machines to identify their IP addresses.

During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.

During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.

During Operation AkaiRyū, MirrorFace used Arp and `dir` for discovery in compromised environments.

During FunnyDream, the threat actors used ipconfig for discovery on remote systems.

During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.

During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing `arp -a` and `nslookup` commands.

During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.

During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.