A threat hunt looks at three attacker changes to a compromised Active Directory, and explains how to both understand and overcome them