Investigation Scenario 🔎 Event ID 5136 on a DC shows msDS-KeyCredentialLink was modified on an old service account. No password reset occurred. What do you examine next to determine who added the credential and whether it was used? #InvestigationPath #DFIR #SOC