A failed PowerShell download, a missing packet, and the tcpdump commands that proved where the connection really died — host firewall, not the attacker.