🌙 The 2AM Alert

An EDR alert fires at 2am: PowerShell spawned from Word on a finance workstation. Work the incident — every choice trades speed against intel against containment.