You are a security analyst reviewing logs in the CrowdStrike Falcon platform. You notice unusual activity involving the repeated execution of a legitimate application, powershell.exe, with a base64-en

Question

Options

• AAn administrator running legitimate scripts to automate system tasks.
• BA malicious actor executing a PowerShell script for credential dumping.
• CRoutine software update activities performed by the IT department.
• DA system error causing the repeated execution of PowerShell.

• A
  3% (1)
• B
  62% (18)
• C
  10% (3)
• D
  24% (7)

Explanation

Option A: While administrators might use PowerShell for automation, it's uncommon to encode commands in base64 unless there's a specific need to obfuscate. This could indicate suspicious activity. Additional context, like logs or administrator intent, is required to confirm this as Option B: This behavior is highly indicative of malicious activity. PowerShell, especially when invoked with encoded commands, is a common vector used by attackers for credential dumping or executing malicious scripts. Reviewing the command and decoding the base64 string is essential to determine the exact purpose of the script. You should isolate the system and conduct further analysis to confirm and mitigate the threat. Option C: Software updates rarely require PowerShell scripts with encoded commands. Confirming this scenario would require verifying the activity against scheduled update logs or communication from the IT team. Option D: System errors can lead to unexpected behavior, but they are unlikely to involve encoded commands passed to powershell.exe. Such activity should be treated as suspicious until proven otherwise.

No community discussion yet for this question.