i would ask chatGPT to go thru your hardening. Jot down all the hardening, AV settings, H_C settings etc and upload it to chat. Tell it to extract the main purpose behind each configuration and setting. And try to find holes following those main purposes. It may not reveal the security hole that the attacker actually used, but at least you have something to enhance. And your enhancement May just cover that security hole that the attacker used. Providing that you did not miss an entire category of defence, it is something worth doing.
Another way to move forward is to rely on your SIEM (if you want a free one, try Wazuh) and logs to find suspicious movements and alterations. It is tedious work going thru miles of alerts, and it's like trying to find a needle in a haystack. But it is evidence based threat hunting. It would help a lot if you have a log of what you did, so you can separate the things that you know you did and eliminate things. I used to keep a configuration log just for that purpose. Then you can recognize suspicious things. And the SIEM will have levels of alerts, so on first pass you can concentrate on the higher level alerts, it may be just be the thing you're looking for. A small agent runs on your PCs and forwards the logs to the SIEM. That SIEM PC doesn't need to be powerful it just needs drive space so an older PC will do.
