Walk me through your first three steps of investigation when you see suspicious PowerShell activity on a domain controller at T-Mobile.
