Various scans and queries are used to find proxy settings, domain controllers, remote desktop services, Citrix services, and network shares. Otherwise, a jump host or other system likely used by domain admins is found and equipped with a Cobalt Strike beacon