Manufacturing Workstation Compromised: Multi-Stage Attack with Persistence and Credential Harvesting

Initial Signal

CrowdStrike Falcon detected a suspicious registry modification on manufacturing workstation ws-001 (10.1.1.1) when the process regedit.exe executed with the command line `regedit.exe "C:\[CUSTOM_DIR_1]\001.reg"` at 09:07:35 UTC on March 11, 2026. This maps to MITRE technique T1547.001 (Registry Run Keys / Startup Folder), a persistence mechanism. What made this alert stand out was not just the registry change itself, but the artifact: a .reg file located in a non-standard directory (`C:\[CUSTOM_DIR_1]\`) with a systematic naming convention (001.reg). The file triggered 73 alerts in rapid succession, revealing a purpose-built attack toolkit targeting 186 specific CrowdStrike Falcon and AMSI registry keys, along with successful registrations of a Password Filter DLL (T1174) and accessibility API ASEP modifications (T1546.008). Investigation correlated CrowdStrike Falcon and Microsoft Defender telemetry over 11 minutes 35 seconds, uncovering a multi-stage attack: DameWare Mini Remote Control deployed via SMB at ~00:55 UTC, followed by network discovery commands, and finally the coordinated persistence and credential theft attack via the 001.reg toolkit. The workstation was also used as a pivot point for RDP lateral movement to internal hosts 10.1.1.3 and 10.1.1.4 over multiple days.

The Questions We Asked

What follows is the path the agent walked to reach its verdict. Pivots and dead ends both made the cut. Routine steps that just ruled out the obvious are grouped together so you can skim past them.

Key Pivots

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Compromised at high confidence rests on the following mutually corroborating signals:

1. CrowdStrike Falcon telemetry provides detailed, corroborated evidence of all attack stages—process trees, command lines, registry keys, and disposition results—with 193 high-severity alerts across multiple MITRE techniques

2. The 'Detection, standard detection.' disposition on RegistryPersistEdit, PasswordFilterDLL, and AccessibilityApiGenericAsepModified alerts definitively confirms those actions were not blocked by Falcon, meaning the persistence mechanisms succeeded

3. The ServiceExecOnSMBFile alert confirms DameWare Mini Remote Control was deployed via SMB admin shares, a hallmark of attacker lateral movement rather than authorized software deployment

4. The purpose-built nature of the 001.reg file—targeting 186 specific Falcon/AMSI registry keys in a single execution—demonstrates deliberate adversarial intent; no legitimate software deployment would construct such a toolkit. Confidence is High (not Confirmed) because the attacker's initial access vector (how they first compromised the network or obtained credentials) and the actual file path and hash of the Password Filter DLL are not fully determined from available telemetry, leaving a gap in the complete attack chain

Lessons

1. 01
   A high block-rate is not containment. In this investigation, 186 blocked tamper attempts against the Falcon sensor looked like a win. The three unblocked primary objectives (Run key persistence, Password Filter DLL registration, accessibility hooks) completed in the same execution. Always audit what did NOT get blocked, not just what did—the blocked count is the distractor. The attacker's secondary goal (disabling Falcon) failed; the primary goals (persistence and credential theft) succeeded.
2. 02
   Purpose-built attack toolkits reveal deliberate intent. The 001.reg file targeting 186 specific Falcon/AMSI registry keys demonstrates this was not opportunistic malware or a generic attack. An attacker spent time building a custom toolkit for this environment. When you see a .reg file with dozens or hundreds of specific registry modifications, especially targeting security tools, treat it as a strong signal of a sophisticated, targeted campaign rather than commodity malware.
3. 03
   SMB-based service execution is a lateral movement red flag. The ServiceExecOnSMBFile alert for DameWare deployment is a hallmark of attacker lateral movement, not authorized software distribution. Legitimate software deployments use MDM, GPO, or signed distribution channels. If you see services or processes executing from SMB shares (\\\\server\\share\\executable.exe), especially admin shares, escalate immediately—this is how attackers move between systems.
4. 04
   Credential harvesting infrastructure succeeding is worse than persistence. The Password Filter DLL registration (T1174) that was not blocked means the attacker can now intercept every password change on this workstation. This is worse than persistence alone because it gives the attacker ongoing access to credentials. When you see T1174 alerts with 'Detection, standard detection.' disposition, treat it as a critical compromise requiring immediate credential rotation for affected users.
5. 05
   Multi-day lateral movement indicates dwell time, not exploration. The RDP connections from ws-001 to 10.1.1.3 and 10.1.1.4 over multiple days (March 8–10) before the final attack on March 11 show the attacker was already established and moving laterally. This wasn't a one-shot attack; it was a campaign with reconnaissance and staging phases. Early detection of the DameWare deployment could have prevented the subsequent persistence and lateral movement.