Skip to main content
Tier One
Low

Software deployment tool flagged as suspicious script execution

A-1067

00:00time on this alert, target 30 minutes

Back to queue

Alert details

Source
EDR
Detection rule
EDR-PS-SCRIPT-EXEC-019
Affected user
svc-backup
Affected host
WKS-HR-02
Source IP
—
First seen
2026-07-24T17:48:00Z

Why this fired, in plain English

PowerShell ran a script file, which the rule treats as worth a look.

Suggested playbook

Suspicious PowerShell execution

  1. 1. Decode any base64 in the command line and read the actual script.
  2. 2. Check the parent process. ccmexec.exe or services.exe is usually management; WINWORD.EXE is not.
  3. 3. Check whether the script file is signed, and by whom.
  4. 4. Look for outbound connections made by powershell.exe and whether they were blocked.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T17:47:12Z host=WKS-HR-02 EventID=4688 process_name="powershell.exe" parent_process="ccmexec.exe" user="svc-sccm" cmdline="powershell.exe -ExecutionPolicy Bypass -File C:\\Windows\\ccmcache\\7f\\install-adobe.ps1"

    ccmexec.exe is the Microsoft software-deployment agent. It is the expected parent for these scripts.

  2. Guided hint: this line matters

    ts=2026-07-24T17:47:12Z host=WKS-HR-02 sensor=edr event=file_info path="C:\\Windows\\ccmcache\\7f\\install-adobe.ps1" signed=true signer="Northwind IT Code Signing"

    The script is signed by the company's own code-signing certificate.

  3. Guided hint: this line matters

    ts=2026-07-24T17:47:58Z host=WKS-HR-02 sensor=edr event=process_exit exit_code=0 duration_sec=46 child_processes="msiexec.exe"

Related events

The order things happened in.

  1. 17:47Z

    Deployment agent runs a signed install script

  2. 17:48Z

    Script exits cleanly

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 2 lookups checked

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.