BusyR

I have seen the exact same issue, same events in the eventlog, on different 2 occasions. Not directly running secretsdump, but using "crackmapexec smb dc01 -u user -p pass --ntds",...

No, no Rapid7 EDR running on the DC's, but both DC's were running Symantec AV. On 2023-03-02 22:55, twosevenzero wrote: > @DeserranoJorden [1] @BusyR [2] @7MinSec [3] In your cases,...