Suspicious PowerShell Offense on a Finance Workstation
An offense titled Suspicious PowerShell fires on a finance workstation at 02:15 local time. It contains 12 events over four minutes, including encoded command lines and a successful logon by a user who is on approved leave. QRadar shows the workstation communicating with an external IP that has no threat-intelligence score, but flow data for that VLAN is limited to 15-minute summaries. The endpoint team has EDR deployed but not integrated with QRadar, and the EDR console shows no alert for the same period. The offense is assigned to a tier-one analyst nearing the end of a night shift. The user's manager is unreachable, and the workstation is used for month-end close starting in six hours. The analyst wants to close the offense as a false positive because the EDR did not alert.
1. Lay out a triage sequence for the next 30 minutes. What would you check first, and what would make you escalate immediately?
Read the worked answer
The EDR's silence is not exculpatory: it may not cover script-block logging, may have been tampered with, or may simply not alert on this behavior. First, verify the offense's raw events: the parent process, the encoded command, the user context, and whether the logon was interactive or network. Second, check QRadar for related offenses and authentication activity for that user and host around 02:15, including whether the user logged in from another location. Third, query the EDR console directly for process and network telemetry on the host, not just alerts. Fourth, resolve the external IP through available reputation and whois data and check whether other assets contacted it. Immediate escalation triggers would be evidence of credential use inconsistent with leave, encoded commands spawning network connections, the same external IP seen on other hosts, or an inability to verify endpoint state. A single unresolved external connection on a finance host before month-end is enough to escalate, even without a positive reputation hit.
2. How would you weigh the limited flow data and the missing EDR integration in your conclusion?
Read the worked answer
Limited flow data changes what I can prove, not what I should do. Fifteen-minute summaries can show that a connection existed and roughly how much data moved, but not the command channel, payload, or whether the traffic was interactive. Missing EDR integration means I must query the endpoint tool directly and record that the correlation gap is an architectural weakness. I would not conclude false positive from absence of evidence in two tools that are known to be incomplete. Instead, I would state the confidence level: endpoint execution is confirmed by QRadar events, user context is anomalous because the user is on leave, and external communication is possible but not characterized. That combination supports escalation and containment, such as isolating the host or forcing credential reset, while the investigation continues. Closing the offense would require positive evidence that the activity was sanctioned, such as an approved script deployment and a matching change record.
3. The analyst wants to close as false positive to avoid waking the on-call team. What coaching and process response is appropriate?
Read the worked answer
The coaching point is that false positive means the detection logic produced an offense without malicious activity, not that the analyst could not confirm malice within the shift. Here the events are real PowerShell executions under a user who is on leave; the unresolved question is intent, not whether the activity occurred. I would require the analyst to document the checks performed, the unanswered questions, and the escalation decision, then hand off to the on-call team rather than close. I would also review whether the night shift has an escalation path that does not depend on reaching a manager, because an unreachable manager should not become a reason to suppress. If the analyst is near end of shift, the correct action is a time-boxed handoff with the offense left open and assigned. I would refuse a closure code that hides the gap, and I would use the case to fix EDR integration and flow retention rather than blame the analyst.