Dritting - What's Happening in the Network?

At this point, we were... That is 100% correct. We are all remote at this point. Luckily, we could... And so you didn't have somebody on site physically? Well, in joking aside, I wanted it to be closer to a weekend because then that means their staff isn't going to be there. If the network's down for a little bit longer, they're less likely to have users yelling at the team and whatnot. So now we had a little bit of time to actually start looking at things. Our plan of attack was we would start with the phishing campaign and we would work forward. Using the indicators of compromise that we were able to determine by looking