The Attack Wasn’t Hidden. We Were Looking at the Wrong Evidence.

How attackers leave small technical clues across logs, processes, DNS, authentication, and network traffic