Post #417 431 Nov 1, 2021, 12:53 UTC From Zero to Domain Adminhttps://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/#blueteam #writeup The DFIR Report From Zero to Domain Admin This report will go through an intrusion from July that began with an email, which included a link to Google's Feed Proxy service that was used to download a malicious Word document. Upon the user enabling macros, a Hancitor dll was executed, which called…