AD Compromise Response

The specialized response to an incident where an attacker has gained control of Active Directory itself, which often means assuming every credential and trust is suspect and may require rebuilding or restoring the directory from a clean state.