Windows Event Logs — Golden Ticket and Kerberos forging detection

Hard GIAC GCIH cybersecurity drill: You are an Incident Responder at Cascade Logistics. A domain administrator password was changed, but the attacker is