Discovery

Enumeration of files and directories using built-in tools. Adversaries may use the information discovered to plan follow-on activity.

Enumeration or discovery of the Windows registry using reg.exe. This information can be used to perform follow-on activities.

The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.

Adversaries may attempt to get information about running processes on a system.