Question

During an investigation, an analyst reviews a Windows PowerShell operational transcript log and finds the following entry: 'powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0AC4A...'. Based on interpreting this command-line log, what event does this entry most likely indicate?

Accepted Answer

An obfuscated PowerShell execution using a Base64-encoded command with a hidden window to evade detection

Answer

A legitimate scheduled maintenance script running with standard parameters

Answer

A normal user opening the PowerShell ISE to write a script interactively

Answer

A Windows Update process invoking PowerShell to apply a security patch