Turla surveys a system upon check-in to discover active local network connections using the "netstat -an", "net use", "net file", and "net session" commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the "GetTcpTable2" API call.