
By the way, enterprise apps is another good way to exfiltrate data, right? Because it has those permissions and you can ask the enterprise app sync data and so on. Um but there's multiple ways to do that. So, I guess the question that we have now as forensic investigators is how did I get to that AD Connect server? Because they can't just show up there automatically, right? Magically.