Active Directory Domain Controller
Named by 4 kept items in this workspace.
Search every workspace for Active Directory Domain Controller. It matches the name as written, so it can find other things that share it.
The items that name it 4
Target whose identity (sAMAccountName, SID, dNSHostName) is spoofed; impersonated via rogue certificate and PKINIT to obtain .ccache and NT hash
Partner's Primary Domain Controller; [User 1]'s domain account used and later disabled
Host where ADWS/LDAP services run; subject of enumeration and correlation logging
Windows Server 2022 (Earth-DC.marvel.local in lab); logs Event IDs 1138, 1139, 1166, 1167, 1644 relevant to ADWS/LDAP enumeration
All technologies in this workspace.