Network reconnaissance
Named by 2 kept items in this workspace.
Search every workspace for Network reconnaissance. It matches the name as written, so it can find other things that share it.
The items that name it 2
Threat actor used winpty-agent.exe shell execution to run ping commands probing internal network segments and ipconfig /all to enumerate host network configuration.
ICMP ping sweeps, NetBIOS name request probes, and SMB-targeted activity including SYN flood behavior exceeding 370 SYNs/second
All techniques in this workspace.