Turla surveys a system upon check-in to discover remote systems on a local network using the "net view" and "net view /DOMAIN" commands. Turla has also used "net group "Domain Computers" /domain", "net group "Domain Controllers" /domain", and "net group "Exchange Servers" /domain" to enumerate domain computers, including the organization's DC and Exchange Server.