ALT-2400 · Sysmon
Encoded PowerShell spawned by Microsoft Word
WINWORD.EXE spawned powershell.exe with a base64 encoded command block moments after a macro-enabled attachment was opened. Behaviour matches a phishing-to-loader chain.
Detection summary
WINWORD.EXE spawned powershell.exe with a base64 encoded command block moments after a macro-enabled attachment was opened. Behaviour matches a phishing-to-loader chain.
- Affected host
- WS-FIN-014
- Affected user
- a.pratama
- Source IP
- 10.20.14.61
- Detection rule
- DET-0142 Office Child Process — Encoded Command
- Log source
- Sysmon
- Assignee
- Unassigned
Recommended actions
- Isolate the endpoint from the network
- Collect the parent document and submit for detonation
- Reset credentials for the affected user
- Block the C2 IP at the perimeter firewall
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Foundation · Theory · 12 min
What a SOC actually does
You have just joined the ACME-CORP SOC as an L1 analyst on the morning shift. Before touching the queue you need to understand how work flows through the team and where your responsibility starts and ends.
Foundation · Simulation · 40 min
Triage 20 alerts against the clock
It is 09:00 and the queue built up overnight. You have a shift's worth of alerts and limited time. Work the queue: confirm what matters, dismiss what does not, and escalate anything that is beyond L1.
Entry · Theory · 16 min
Speaking ATT&CK
Three critical alerts are open. Each describes a different attacker goal. To discuss them with anyone else in security you need the ATT&CK vocabulary.