Advent of Cyber 2024 Day 15: Be it ever so heinous, there’s no place like Domain Controller.
Lab link. Questions 1. On what day was Glitch_Malware last logged in? Answer format: DD/MM/YYYY 07/11/2024 2. What event ID shows the login of the Glitch_Malware user? 4624 3. Read the PowerShell history of the Administrator account. What was the command that was used to enumerate Active Directory users? notepad “$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt” Get-ADUser -Filter * -Properties …