Don't have Telegram yet? Try it now!
https://www.andreafortuna.org/2018/06/13/analysing-active-directory-event-logs-to-identify-compromised-accounts/
Analysing Active Directory event logs to identify compromised accounts