Is it safe to disable the ILS_ANONYMOUS_USER account?
I found an account named ILS_ANONYMOUS_USER in our environment. It was created in 2004 and has the description "Anonymous Account for ILS Server." Some documentation suggests it may…
lateral movement
How can I tell normal admin activity from a compromised account doing domain reconnaissance?
I'm reviewing activity from an IT administrator account and need to determine whether it reflects routine administration or possible compromise. The account generated extensive LDAP queries against domain…
How can I tell whether widespread SAMR enumeration is normal admin work or a compromised account?
I'm reviewing activity from an IT administrator account and need to determine whether it reflects legitimate administration or internal reconnaissance. The account generated numerous LDAP queries against domain…
How Can I Investigate Unauthorized Access and File Transfers by a Former Admin?
I'm currently working on a forensic investigation involving a former systems administrator. We've found that they manipulated their permissions in Active Directory before leaving, which raises some serious…