HYPOTHESIS

The Gentlemen stolen credentials + MFA bypass: session cookie reuse from geographically implausible locations with MFA bypass; requires geo/ASN enrichment across auth logs (T1078)

Full hunt detail (hypothesis reasoning + how-to-run query concept) syncs from the case's 04-hunts.json on the next intel refresh.