Claim

Tinker Secor USES SYSVOL

Tinker used a stolen user's credentials to access SYSVOL and retrieve domain scripts and configuration information.

Episode
EP 36 — Jeremy from Marketing
Origin
Explicit
Confidence
99% (extractor score, not a fact score)
Speaker
Tinker Secor
Attributed source
—

Transcript evidence

“I logged into SYSVOL on the main controller”

Tinker Secor · offsets 27953–27996

“You can mount SYSVOL and get all the group post preference.”

Tinker Secor · offsets 28031–28090

Read the official transcript

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:38:56.137273+00:00

claim:ep036:343d3c3691c2