“Sable began with an initial port scan of 10.10.1.10 and then authenticated to the target.”

That would have started a P2 and woken up a senior IR responder anywhere that I’ve worked. Are you sure you’re running a realistic defender environment?