### Overview
Following lateral movement, attackers are executing reconnaissance commands to gather information about the network.

### Details
- **Commands Used**: Network mapping tools, system enumeration commands.
- **Purpose**: Identify critical systems and data of interest.
- **Indicators**: Unusual network scans and command executions.

### Next Steps
Anticipate data collection attempts for exfiltration. Implement monitoring to detect unusual data access patterns.