In compromised environments, attackers proceeded with post-authentication reconnaissance, issuing lightweight directory access protocol (LDAP) queries and running tools like ADExplorer64.exe to map ...

There were also LDAP requests that are usually associated with Active Directory reconnaissance activities ... which was used to set domain groups and access rights to several domain controllers, were ...