A security analyst reviewing endpoint telemetry notices that winword.exe spawned powershell.exe, which then executed a heavily encoded command that downloaded and ran additional code directly in memory. No malicious file was ever written to the disk, so the file-based antivirus scan came back clean. Which type of endpoint-based attack does this behavior BEST describe?