Turla used

Turla surveys a system upon check-in to discover running services and associated processes using the

Turla surveys a system upon check-in to discover running processes using the

Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Turla surveys a system upon check-in to discover network configuration details using the

NBTscan.(Citation: Kaspersky Turla)(Citation: Symantec Waterbug Jun 2019)(Citation: ESET ComRAT May 2020)

Turla RPC backdoors have also retrieved registered RPC interface information from process memory.(Citation: ESET Turla PowerShell May 2019)|