We caught a threat actor, called MuddyWater, bruteforcing a login for our Domain Controller.
We have an old Windows Server 2008 instance that we lost the password for. Can you see if you can find one in this packet capture?