Mitigation Lessons from 598 Incident Responses: DarkGate Malware, LotL Techniques, and Rclone Attacks