A user on a compromised website pastes a single copy-and-paste 'fix' command into the Run dialog. Through a LOLBin proxy chain (pcalua -> mshta -> msiexec) the Potemkin loader is silently installed, which then reflectively loads a credential-stealing module (RMMProject) entirely in memory. A human operator takes over, pulls in the blockchain-resolved EtherRAT backdoor, tunnels out through a renamed cloudflared, moves laterally to the domain controller and dismantles Defender step by step. The whole intrusion starts on one endpoint that had no monitoring agent - the single point where none of the signals below could ever have fired.

A domain Administrator credential logged into an internet-exposed RDP host (no brute force), and 2h49m later Trigona was encrypting the whole network over SMB. Every step rode valid admin creds and built-in tooling, so each signal alone reads as legitimate administration. The incident is only defensible by chaining the steps on one identity within a 3h window. This is the cleanest possible proof that fidelity lives in correlation, not in any single query.