@blackmatter23 2. possibly exchange got exploited 😆 verify if dcsync was successful from event logs. the cmd.exe suggests attacker has remotely accessed with m.berger but idk 🤷‍♂️ for whatever dumb reason has not created a tunnel but thinks of doing dcsync from exchange leaving more evidence.