Four alerts investigated end to end

reg.exe attempted to write a backdoor path into HKCU\Environment\UserInitMprLogonScript, a registry key that executes before the desktop loads on every login.

CrowdStrike blocked the registry write and killed the process. A backdoor file was already present at C:\backdoor.exe, confirming prior write access to the machine before this alert fired.

Review the 46 unresolved prior alerts on this host. The presence of the backdoor file suggests this was not the first malicious action. Recommended a full re-image rather than surgical remediation.

reg.exe ran reg save HKLM\SAM C:\sam.hiv, copying the Windows SAM database, which stores local account password hashes, to a file on disk.

The command ran inside an existing cmd.exe session, meaning access to the machine was already established. The same session also disabled User Account Control, removing the elevation prompt for future actions.

Reset all local account credentials immediately and investigate how the initial session was established. UAC being disabled in the same session signals the attacker was preparing for follow-on activity.

findstr.exe searched for cpassword across SYSVOL policy files. This targets an old Group Policy Preferences field where administrators historically stored passwords using an encryption key Microsoft has since published publicly.

The search came back empty because this was a standalone workstation with no domain access to SYSVOL. The technique itself only failed because of where it was run, not because the attacker avoided it. CrowdStrike killed the parent process.

Treat confirmed intent regardless of the empty result. The same command against a Domain Controller would likely have succeeded. Recommended auditing whether any GPP password fields exist in the environment.

rundll32.exe called comsvcs.dll MiniDump against the LSASS process, which holds credential material in memory. This technique uses three legitimate Windows components, giving antivirus nothing to scan on signature.

Sensor action was None, meaning CrowdStrike detected but did not block. The detection fired on Windows-10, a different host from the earlier cases, confirming the attacker had moved laterally across the environment.

Immediate network isolation of Windows-10, credential reset for all accounts on both hosts, and a hunt for lateral movement across the full environment. Treat all credentials in scope as potentially compromised.