The First 72 Hours: An Intelligence-Led Analysis of Post-Compromise Behavior and Attacker Velocity