Detected execution of unauthorized scripts on an endpoint aimed at exploring the network for systems with valuable source code. This activity is indicative of an attacker attempting to broaden their access and control.