DC Under Siege

RDLAB035 has been struck by a critical ransomware incident targeting its main Domain Controller, severely disrupting operations and raising concerns about a full-scale compromise. As part of this DFIR lab simulation, you are brought in as the incident responder tasked with analyzing the situation using logs provided by the internal SOC team. Although the attack was officially reported at 21:39, your investigation must go further back in time to uncover the attacker’s initial access, trace their movements across the environment, and reconstruct the full kill chain.

By examining authentication events, suspicious processes, and anomalous behavior within the logs, you will work to identify how the breach occurred, what actions were taken, and which assets were impacted, ultimately building a clear picture of the incident to support an effective response.

Can you identify the key indicators of compromise (IOCs), reconstruct the attacker's kill chain, and determine the root cause of the incident?