Encoded PowerShell on a Finance Laptop During Month-End Freeze
At 09:12 on a Tuesday, EDR alerts on FIN-WS-114, the laptop of an accounts-payable clerk: WINWORD.EXE spawned powershell.exe with the -enc and -nop flags, which wrote a 2 KB blob into HKCU\Software\Classes\CLSID and then exited. No file was written to disk. A proxy log shows one blocked CONNECT attempt to an address in the 185.x range. The clerk says she opened an invoice attachment from a regular supplier. At 11:40 a second machine on the same floor shows the identical parent-child pair. The EDR console offers isolate host, kill process, and collect triage package. Her mapped drives point to a finance file share holding 900 GB, backed up nightly but never restore-tested. A change freeze for month-end close is in effect until Friday.
1. State your first 30 minutes of actions in order, with the reasoning for each step.
Read the worked answer
Validate before acting, but validate quickly. Pull the EDR process tree and command line from the console rather than remoting into the host. Office spawning an encoded PowerShell child is not a normal macro behavior, and the registry write into HKCU\Software\Classes\CLSID is a stager location used for fileless persistence. Two hosts with the same pair makes accidental cause implausible.
Isolate, do not just kill. Kill the process and the loader that produced it stays; isolate and you stop both lateral movement and any callback attempt while preserving memory for the triage package. The proxy blocked one CONNECT, which is not proof that every attempt failed.
Collect the triage package and volatile data while the host is still isolated and running. Memory, autorun keys, WMI persistence, scheduled tasks, and the parent document.
Scope before you remediate. The second host on the same floor suggests a phishing wave to a group, so pull mail gateway logs for the sender and all recipients, and hunt the encoded command string and registry path across all 1,200 endpoints. Isolating only the two known hosts guarantees a third appears on Friday.
Notify the finance owner that mapped drives may be at risk, without blocking the freeze yet.
2. Which artifacts decide the scope of this incident, and what would each tell you?
Read the worked answer
Mail gateway and EDR telemetry answer the breadth question; host artifacts answer the persistence question.
Breadth: sender address and subject of the invoice, all recipients on the same campaign, and delivery timestamps. Then the EDR fleet query for the exact encoded command and for any WINWORD-to-PowerShell child process in the last 30 days. Both together catch users who deleted the mail.
Persistence: autorun entries, services, scheduled tasks, and WMI event subscriptions on the isolated hosts. WMI subscriptions matter here because a fileless stager often re-establishes through them and survives reboots without a file.
Execution history: PowerShell script block logging and module logging if enabled, which give you the decoded command without needing memory forensics. If they are not enabled, this incident is the argument for turning them on.
Credential exposure: whether the clerk's account authenticated anywhere unusual after 09:12. A fileless loader frequently exists to steal credentials, so this determines whether you also need a password reset and session revocation, which is a larger action during month-end than reimaging a laptop.
Lateral indicators: SMB and WinRM logons from FIN-WS-114 to the file share in the window, checked server-side, not from the client.
3. The finance director wants the machines cleaned, not rebuilt, so the clerks can work through close. Recommend an approach and justify it.
Read the worked answer
Rebuild, but sequence it so it costs hours, not days. Cleaning is defensible only when you can enumerate every persistence mechanism the loader installed. Here you have a registry-based stager, an unknown decoded payload, and a probable second stage that never completed because the proxy blocked it. That is precisely the case where a clean scan is not evidence of a clean host.
The freeze argument is weaker than it appears. Month-end change control targets ERP and financial system changes; replacing an infected endpoint with a loaner is an incident response action, not a change to a controlled system. Get the finance director's written acknowledgment and proceed. Keep both hosts isolated and preserved until a forensic image is captured, so rebuilding does not destroy evidence you may need for the vendor notification decision.
Practical path: image both disks, issue loaners with restored profiles, reimage from known-good media, reset the clerk's credentials and revoke sessions, then re-enable network access only after the fleet hunt returns no further matches. Track time-to-restore as a metric; if a 900 GB restore has never been tested, this is also your first real test of the backup path, and you should say so to the director before Friday rather than during it.