The console was new. They’d only pushed (Release Update 7) to the production environment three days ago. The vendor promised it was their “most resilient AI-driven kernel” yet. Management had approved the update for one reason: the new Advanced Machine Learning engine could detect fileless malware before it even touched RAM.

Workstation WS-ACCT-09 (Angela Cortez, Junior Accountant – left at 6:02 PM) Target: Domain Controller DC-01 Payload type: Memory-only reflective DLL. No write. No file. No signature.

Vale exhaled. “Do it. But Maya—if you’re wrong, you just gave a rootkit a backdoor into our crown jewels.”

A pause. Then: “Good. Leave the honeypot running. Let them talk to the ghost.”

Maya leaned back. Outside, the city was dark. Inside, Symantec Endpoint Protection 14.3 RU7 silently watched the fake domain controller, logging every lie the hacker typed, while the real network slept peacefully for the first time all week.