The biggest fail here was that 32 bit program warning, which probably alerted the employee.
Notice that they didn't actually have an alert for Firefox+Shell, they detected that later by inspecting the audit logs.
Notice that they didn't actually have an alert for Firefox+Shell, they detected that later by inspecting the audit logs.
They explicitly state it was one of the behaviors they detected as suspicious.