312-39V2: Certified SOC Analyst v2

Question

A SOC analyst identifies multiple instances of powershell.exe launched with the -ExecutionPolicy Bypass and -NoProfile arguments on a domain controller. The parent process is winrm.exe, and the activity takes place outside business hours. What should be the analyst’s main focus?

Explanation

Event ID 4688 records process creation and can include the process command line and creator process when command-line process auditing is enabled. Reviewing comparable 4688 events over the prior 24 hours directly scopes potentially unauthorized WinRM-initiated PowerShell executions and provides the relevant command, parent-process, account, and timing evidence.

Learn more

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ49

Community Discussion