During the 2016 Ukraine Electric Power Attack, It checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.