What Are Some Takeaways From What You Saw?

The other big thing for me is cross domain trust. There were three different domains and all it took was Kerberosting on one to spread to the other two. So if you have multiple domains, block them down. Zero trust is always best. But I also do recognize that that's not always the easiest practical setup, but that's the thing about security. It's not supposed to be easy.