QuestionQ8

VerifiedHunting Methodology

You receive several automated detections of a script named 1.ps1 executing across several different endpoints.

What action should you take first to determine whether the script is malicious?

Explanation

Reviewing ScriptControl events provides the script content needed to assess its commands, behavior, and indicators of malicious activity. This is the appropriate initial triage step before containment or remediation actions.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!