Following in the footsteps of an attacker and uncovering their digital footprints, this session will show attendees the attacker’s techniques used and how they went from zero to full domain admin compromise, which resulted in a nasty ransomware incident.