A SOC analyst detects multiple instances of powershell.exe being launched with the -ExecutionPolicy Bypass and -NoProfile arguments on a domain controller. The parent process is winrm.exe, and the…

Question

Options

• ALook for Event ID 4625 to check for failed authentication attempts before execution
• BInvestigate Event ID 7045 to determine if a malicious service was created
• CSearch for Event ID 4688 to find similar PowerShell executions within the last 24 hours
• DReview Event ID 5145 to see if unauthorized network shares were accessed

• A
  12% (3)
• B
  27% (7)
• C
  58% (15)
• D
  4% (1)

Explanation

The highest-signal next step is to scope and confirm the suspicious execution pattern by identifying related process creation events. Event ID 4688 records process creation in Windows Security logs when auditing is enabled, and it can capture command-line details that confirm the use of - ExecutionPolicy Bypass and -NoProfile, as well as parent/child relationships. Since the activity is on a domain controller and the parent is winrm.exe (remote management), the SOC must quickly determine whether this is isolated or part of a broader remote execution campaign. Searching for similar 4688 events over a relevant window (such as the last 24 hours) helps identify frequency, affected accounts, and whether the same command line or script path appears across hosts. Event ID scope the suspicious PowerShell executions already observed. Event ID 7045 (new service installation) is important if there are signs of service-based persistence, but it is a different hypothesis. Event ID 5145 is about network share access and can be useful for lateral movement, but the immediate priority is to scope execution behavior. Therefore, focusing on 4688 process creation for similar PowerShell executions is the best primary step.

No community discussion yet for this question.