[rwth-security] Investigating a SharePoint Compromise: IR Tales from the Field