The tool says no Windows audit logs. We checked. Part 5A proved the ADWS blind spot exists. Part 5B proved it’s solvable. Event 5156 gives you the real attacker IP behind localhost. The data was always there. Nobody was correlating it. Part 6 introduces a different blind spot. One that lives in a protocol your entire detection stack has never looked at, and a tool that is more detectable than its ...