Suspicious data exfiltration activity was detected from the domain controller. This involved the transfer of sensitive data to an external IP address, indicating an attempt to move stolen credentials and data out of the network.