What are the primary indicators of compromise (IoCs) you would look for if you suspected a network intrusion at HD Supply?