Tracing a Domain Compromise: Key Active Directory Logs and Indicators of Compromise to Check First Golden Ticket and DCSync indicators, GPO tampering, AdminSDHolder ACL abuse, SID History injection, and domain controller logon anomalies to check first when AD itself is suspected of compromise. Sep 6, 2026 4 min read Active Directory / Security
How to Investigate a Compromised Exchange Server: A Practical Incident Response Checklist (Exchange 2016/2019) The exact checklist for triaging a suspected Exchange compromise: web shell locations, IIS log indicators, mailbox export/permission abuse, transport rule tampering, and what to preserve before remediating. Sep 6, 2026 4 min read Exchange / Security
