The attacker installed a backdoor on the domain controller to ensure long-term access. A suspicious service named 'WinSvcHelper' was created and linked to a known malicious executable 'svcbackdoor.exe'.