A failed PowerShell download, a missing packet, and the tcpdump commands that proved where the connection really died β€” host firewall, not the attacker.