Volt Typhoon: living-off-the-land in critical infrastructure

A water-utility SOC flagged off-hours activity on an internet-facing host, but there is no exploit and no failed-login storm to anchor on. Work the web and identity records and identify the host where the intrusion took hold.

The operator's command channel is a single file hiding in plain sight among legitimate application pages. Identify the server page that was planted to run commands.

Before touching the directory core, the operator harvested credentials from memory on the foothold host using nothing but a built-in component. Identify the signed system DLL that was abused to read the credential process.

Command-and-control never went straight to a data-center IP, it was relayed so the egress looks like home internet. Pin down the external address the relay forwarded traffic to.

The decisive move was lifting the entire domain credential store off the controller without any malware. Determine which host the Active Directory database was exported from.

Before disengaging, the operator tried to erase the trail on the foothold host. Pin down the exact time the Security audit log was wiped.

Summarize for the incident report how the operator obtained every domain credential at once. Map the directory-database theft to its MITRE ATT&CK sub-technique.