Discovery
Named by 2 kept items in this workspace.
Search every workspace for Discovery. It matches the name as written, so it can find other things that share it.
The items that name it 2
Mining email content, contacts, and workflows after initial access
Threat actor ran net.exe group "domain computers" /do, quser.exe, setspn.exe -Q VeeamBackupSVC/*, and ipconfig.exe /al to gather information about users, running services, and configurations
All techniques in this workspace.