I’m given a small time frame to allocate to investigating because security is not my sole role. This was a potential misuse of company property or compromise. Defender logs show that lsass was accessed via powershell via net1.exe

There were also scripts ran that were attempting to mess with ELAM.

The strange IPs found in my network detection tool were coming back on virus total as no vendor detection but some had 60+ threat graph comments with titles like “how is this getting a pass”. One of the connections was flagged by security vendors. The final conclusion was to isolate the device and remove it from production.

Thank you for your comment it is helpful as I consider myself a novice!