● MONITORING▲ ANOMALY DETECTED● THREAT CONTAINED ↑ 480 MB → RU Moscow, RU · attacker host BNE laptop · BYOD · trusted
08:42:11  agent   › screenconnect.exe started on BNE-LT-07
08:42:12  session › remote control by “Microsoft Support” — unverified
08:42:13  ⚠ behaviour anomaly — ScreenConnect calling Moscow, RU (unexpected)
08:42:14  ⚠ data-egress spike — 480 MB leaving the network
08:42:14  ⏹ AUTO-CONTAIN — endpoint isolated before banking login