In this attack, Microsoft saw attackers using Cobalt Strike and report they stole credentials — including the Active Directory database — and exfiltrated data using rclone.