Triage & Tuning: Encoded PowerShell from IT Automation (False Positive)
Root-cause analysis of a high-severity encoded PowerShell execution alert, verifying legitimate Microsoft Configuration Manager (SCCM/MECM) hardware inventory automation, and authoring a tuned detection exclusion.
Environment: Training Lab — This investigation was performed in an isolated training environment. Indicators, systems, accounts, and other data shown here are simulated or sanitized unless otherwise stated.
- Validated parent process binary: C:\Windows\CCM\CcmExec.exe signed by Microsoft Corporation.
- Decoded Base64 parameter to benign WMI hardware query: Get-WmiObject Win32_Processor.
- Confirmed zero network socket connections in Sysmon Event ID 3.
- Validated normal execution exit code 0 without secondary file drops.
Executive Summary
A SIEM correlation alert flagged an encoded PowerShell command running under NT AUTHORITY\SYSTEM on workstation WKSTN-0104. Forensic process ancestry revealed the parent process was CcmExec.exe (Microsoft Endpoint Configuration Manager). Decoding the Base64 payload revealed a standard WMI hardware inventory query. The parent binary was cryptographically validated using Sysinternals Sigcheck against Microsoft Corporation root certificates. The alert was closed as a Benign / False Positive, and a tuned SPL exclusion was authored to prevent alert fatigue.
Scenario & Trigger
The SOC alert queue received an alert for encoded PowerShell execution under SYSTEM privilege. The analyst was tasked with determining whether this represented privilege escalation / lateral movement or benign administrative tooling.
index=endpoint_winevt EventCode=1 Image="*\\powershell.exe" User="NT AUTHORITY\\SYSTEM" CommandLine="*-EncodedCommand*" | table _time, ComputerName, User, ParentImage, CommandLineDetection Logic & Queries (Splunk SPL & Microsoft Sentinel KQL)
index=endpoint_winevt EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *") NOT (ParentImage="*\\CcmExec.exe" ParentCommandLine="*CcmExec.exe*") | table _time, ComputerName, User, ParentImage, CommandLineDeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has_any ("-EncodedCommand", "-enc") | where not (InitiatingProcessFileName =~ "CcmExec.exe") | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLineInitial Evidence
- Endpoint: WKSTN-0104.corp.local (192.168.40.115)
- Account: NT AUTHORITY\SYSTEM
- Process: powershell.exe (PID: 7128)
- Parent Process: C:\Windows\CCM\CcmExec.exe (PID: 1844)
- Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAbwByACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwAIABOAHUAbQBiAGUAcgBPAGYAQwBvAHIAZQBzAA==
Investigation Methodology & Narrative
Step 1: Retrieved Sysmon Event ID 1 for PID 7128. Confirmed parent process was C:\Windows\CCM\CcmExec.exe running under NT AUTHORITY\SYSTEM.
Step 2: Decoded the Base64 command line in CyberChef: "Get-WmiObject Win32_Processor | Select-Object Name, NumberOfCores". This is a standard non-destructive WMI hardware inventory query.
Step 3: Inspected the executable C:\Windows\CCM\CcmExec.exe using Sysinternals Sigcheck. Verified valid digital signature signed by Microsoft Corporation (Thumbprint: a81f803c14a42e128efcb9287c88df34927f8a12).
Step 4: Checked Sysmon Event ID 3 (Network Connections) for PID 7128. Zero external or internal network connections were initiated by the PowerShell process.
Step 5: Verified SCCM deployment schedule with Internal IT Systems Administrator. Confirmed automated weekly client hardware audit job at 09:15 UTC.
Step 6: Documented false positive root cause and authored detection tuning exclusion filtering CcmExec.exe parent process from generic PowerShell encoding rule.
Incident Timeline
| Time (UTC) | Event | Telemetry Source | Analyst Note |
|---|---|---|---|
| 09:14:00 UTC | CcmExec.exe initiated routine scheduled inventory task | Sysmon Event ID 1 | Microsoft Endpoint Configuration Manager client cycle initiated |
| 09:14:02 UTC | powershell.exe spawned with Base64 encoded WMI query | Sysmon Event ID 1 | Triggered alert WIN_SUSP_POWERSHELL_ENCODED |
| 09:14:04 UTC | powershell.exe process terminated normally (Exit Code 0) | Sysmon Event ID 5 | Execution completed in 2.1 seconds; zero network sockets opened |
| 09:18:00 UTC | Analyst verified binary signature via Sigcheck | Sysinternals Sigcheck | CcmExec.exe signature valid: Microsoft Corporation |
| 09:22:00 UTC | Alert closed as Benign / False Positive with tuning proposal | SOC Incident Ticket | Tuned rule submitted to Detection Engineering queue |
Indicators of Compromise (IOCs)
| Type | Observed Value | Context | Reputation |
|---|---|---|---|
| File Name | CcmExec.exe | Legitimate Microsoft Endpoint Configuration Manager agent binary | Benign |
| SHA-256 | 9f83a45c3822d64a270f2f3d61a8ef1897c889f0293a90321584b4249a5b6728 | Verified hash of signed C:\Windows\CCM\CcmExec.exe | Benign |
Log Analysis & Telemetry Dissection
EventCode=1
UtcTime: 2026-09-20 09:14:02.115
ProcessGuid: {87d3a014-4112-66eb-a402-000000001400}
ProcessId: 7128
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAbwByACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwAIABOAHUAbQBiAGUAcgBPAGYAQwBvAHIAZQBzAA==
User: NT AUTHORITY\SYSTEM
ParentProcessGuid: {87d3a014-40e1-66eb-a302-000000001300}
ParentProcessId: 1844
ParentImage: C:\Windows\CCM\CcmExec.exe
ParentCommandLine: "C:\Windows\CCM\CcmExec.exe"Analysis Note: Documents the execution of powershell.exe by the signed enterprise management agent CcmExec.exe to collect hardware inventory metrics.
MITRE ATT&CK Mapping
| ID | Technique | Tactic | Observed Evidence |
|---|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Execution | PowerShell invoked by administrative management agent for WMI telemetry |
Findings & Final Classification
Recommended SOC Response & Hardening
- •Close ticket as False Positive / Benign Activity.
- •Implement tuning exception in Splunk SPL alert rule WIN_SUSP_POWERSHELL_ENCODED to filter ParentImage="*\\CcmExec.exe".
- •Maintain audit logging for CcmExec.exe hash deviations to prevent binary replacement or DLL search-order hijacking.
Analyst Reflection: What I Learned
• Distinguishing true attacks from benign administrative automation requires verifying parent binary integrity, digital signatures, and decoded payload semantics.
• Closing false positives with documented tuning recommendations prevents SOC alert fatigue and preserves analyst focus for genuine threats.