Question

A CySA+ analyst is reviewing EDR telemetry on a Windows workstation after an alert fired. The process tree shows that WINWORD.EXE (Microsoft Word) spawned cmd.exe, which then launched powershell.exe with an encoded command that reached out to an external IP. No legitimate business macro is deployed in the environment. Which host indicator is the strongest evidence of malicious activity in this telemetry?

Accepted Answer

An unusual parent-child process relationship in which an office document application spawns a command shell and encoded PowerShell

Answer

The workstation is running Microsoft Word, which is not on the approved software baseline

Answer

PowerShell is installed on the workstation and available to standard users

Answer

The external IP address is not listed in the organization's asset inventory