Host Discovery for Lateral Movement

Enumerate reachable remote systems by IP address, hostname, or another network identifier. Follow-on share, administrative-access, and management-service checks can prioritize candidates for lateral movement; a discovered host, open port, or admin-access result alone does not prove that lateral movement succeeded.