Refer to the exhibit. An alert came with a potentially suspicious activity from a machine in HR department. Which two IOCs should the security analyst flag? (Choose two.)

The correct answer is D. cmd.exe starting powershell.exe with Base64 conversion E. WScript.exe acting as a parent of cmd.exe. The repeated invocation of cmd.exe to launch PowerShell with Base64‐encoded payloads is a strong IOC, as legitimate scripts rarely use this pattern. Seeing WScript.exe as the parent of cmd.exe indicates script‐hosted execution chains-another red flag for malicious activity.

Submitted by luis.pe· Mar 6, 2026Incident Response Techniques

Question

Exhibit

Options

Apowershell.exe used on HR machine
Bcmd.exe executing from \Device\HarddiskVolume3\
CWScript.exe initiated by powershell.exe
Dcmd.exe starting powershell.exe with Base64 conversion
EWScript.exe acting as a parent of cmd.exe

How the community answered

(38 responses)

A
5% (2)
B
3% (1)
C
5% (2)
D
87% (33)

Explanation

The repeated invocation of cmd.exe to launch PowerShell with Base64‐encoded payloads is a strong IOC, as legitimate scripts rarely use this pattern. Seeing WScript.exe as the parent of cmd.exe indicates script‐hosted execution chains-another red flag for malicious activity.

Topics

#IOC#process analysis#PowerShell#Base64 encoding#endpoint forensics

Community Discussion

No community discussion yet for this question.

Full 300-215 Practice