Windows domain controllers
Named by 2 kept items in this workspace.
Search every workspace for Windows domain controllers. It matches the name as written, so it can find other things that share it.
The items that name it 2
Traces of attacker activity, BYOVD tool fragments, and ransom notes found on the victim organization's domain controllers
Log LDAP queries as Event ID 1644 (Directory Service); translate OID-based LDAP matching rules into bitwise operators before logging
All technologies in this workspace.