 Throughout the reconnaissance and gaining-entry phases, we saw these legitimate tools used for specific purposes:   PowerShell: for reconnaissance and persistence  Metasploit Framework: for reconnaissance Mimikatz: for reconnaissance BloodHound: for reconnaissance Cobalt Strike: for installation  For modern ransomware like DarkSide, gaining initial access no longer immediately leads to ransomware being dropped.