How can I tell normal admin activity from a compromised account doing domain reconnaissance?
I'm reviewing activity from an IT administrator account and need to determine whether it reflects routine administration or possible compromise. The account generated extensive LDAP queries against domain…