Question

During an incident investigation, an analyst reviews a compromised Windows workstation and finds a scheduled task named 'GoogleUpdateCheck' configured to run a PowerShell script from C:\Users\Public\svc.ps1 every 30 minutes, triggered whether or not a user is logged on. The task was created three days ago at 02:14 by the SYSTEM account, but the organization has no such maintenance job documented. Which conclusion is BEST supported by these host indicators?

Accepted Answer

The adversary established persistence using a scheduled task to repeatedly execute a malicious payload

Answer

This is legitimate Google Chrome auto-update behavior and requires no further action

Answer

The workstation is being used as a staging host for data exfiltration over HTTPS

Answer

The activity indicates lateral movement to adjacent hosts via SMB