An attacker logs in with a stolen domain admin credential. Every tool in your stack sees a legitimate administrator using…