CrowdStrike Investigations
Four alerts investigated end to end
Each one shows what happened, how I confirmed it, and what I recommended.
CASE 001
Registry persistence attempt
A process tried to add a backdoor to a logon script registry key so it would run every time the machine started. Blocked before it could write.
CASE 002
Local password database accessed
A command copied the Windows SAM file, which stores local account password hashes, and User Account Control was switched off in the same session.
CASE 003
Search for stored credentials
A search ran across Group Policy files for an old password field that some networks still use. The search came back empty on this machine.
CASE 004
Attempt to read system memory
A built in Windows tool tried to copy the memory of a process that stores login credentials. Blocked while it was in progress.