Found a box with Conficker running internal. Had several hours of meetings over a couple days trying to explain that no, applying the patch for MS08-067 was not enough.
Finally convinced them to go into Incidence Response mode.
Learned later the whole network was full of cryptominers.
What joy!