Help: Found suspicious outbound traffic to Russian IPs

This is a potential active compromise. Treat it as an incident.

1. DO NOT alert the attacker by blocking the IPs yet
2. Capture a full packet capture of the traffic
3. Image the domain controller’s memory using tools like WinPmem
4. Check for scheduled tasks, services, and startup items that shouldn’t be there
5. Look for Kerberoasting or Golden Ticket indicators
6. Engage your IR team or an external firm immediately

A compromised domain controller is a worst-case scenario. The attacker likely has full domain admin access.