Indicators of compromise · Question 11 of 12
On an office PC, winword.exe starts a powershell.exe process with a long Base64-encoded command. What is the most plausible assessment?
1 answer is correct. Hard
Show answer
Answer
- A A macro has probably downloaded malicious code
Explanation
Office programs do not normally start PowerShell with encoded commands. This parent-child relationship is a typical indicator of a malicious macro that loads further malware. EDR rules that block such process chains prevent many attacks.