The Lazarus group has been observed using Windows commands that differ from Andariel, such as preferring the “-ano” option with the “netstat” command and “find” as a filter command, rather than “findstr