Incident response investigation of a compromised Windows endpoint. Reconstructed the full attack chain using Sysmon logs, Windows Event Logs, and network packet capture covering initial access, ...