It was an intrusion, they even got into the hosts and datastores.
What you can do is limit access and damage if someone is compromised. Sure maybe a file share gets hit but with secure documentation and an internal firewall (not just a perimeter firewall) you can separate machines on the network properly and just restore from a backup if someone is compromised.
Things like MFA (multi factor authentication) will also help stop that in the first place.
It's a bit of a pain in the ass to set up and get it all right, and takes a bit more work for say Devs who want to run a new app but it's way better than rebuilding the network from almost scratch.