Signal file // INC-003Severity // HighConfidence // Confirmed

Public-safe true-positive investigation · Script execution

PowerShell download chain confirmed as malicious

Confirmed malicious activity

Public-safe case study Customer names, domains, employee identifiers, exact user addresses, internal evidence locations, and case-specific identifiers have been removed or replaced. Quantitative findings and defensive lessons are retained for educational use.

Executive assessment

At 14:22 UTC, WINWORD.EXE launched hidden PowerShell with a 1,840-character encoded command on WKSTN-HR-118. PowerShell retrieved a 286 KB second-stage script, reconstructed it in memory, and registered scheduled-task persistence. Script-block, DNS, proxy, AMSI, and endpoint telemetry confirm a malicious download chain. The host was isolated in 10 minutes 49 seconds.

1Affected workstation

6Correlated stages

286 KBDownloaded content

12,418Peer endpoints searched

95% autonomous investigation. 100% human authority.

TandemTrace AI agents completed 38 of 40 recorded investigation actions autonomously. The human analyst retained final verdict approval and containment authorization.

Investigation ownership

Agents reconstructed the chain. The analyst controlled the consequential decisions.

95% AI agents

38Autonomous actions2Human decisions

Investigation stageAIHuman

Evidence collection100

Script decoding and enrichment90

Cross-source correlation80

Hypothesis testing60

Scope and prevalence50

Verdict approval01

Containment authorization01

Agent-to-human handoff

Orange = AI · black diamond = human · green = response

14:22:35Agent collected Office ancestry and decoded the PowerShell launcher.

14:22:51Agent joined DNS, proxy, script-block, and AMSI telemetry.

14:24:25Agent reconstructed the download, memory execution, and persistence chain.

14:26:08Agent enriched the infrastructure and recovered payload artifacts.

14:29:47Agent searched 12,418 peers and tested benign administration hypotheses.

14:30:12Agent assembled the evidence-backed true-positive recommendation.

14:30:28Human analyst approved the true-positive verdict.

14:31:06Human analyst authorized endpoint containment.

14:33:20Endpoint isolation completed.

Investigation dataset

Case context

Alert source: EDR · Suspicious PowerShell
First observed: 2026-07-22 14:22:31 UTC
Host: WKSTN-HR-118 · Windows 11 23H2
Identity: j.ortiz · People Operations
Origin: benefits-review.docm attachment

Telemetry reviewed

Endpoint: 1,864 events · ±30 minutes
PowerShell: 19 events · 3 script blocks
Network: 6 DNS queries · 2 proxy GETs
Prevalence: 12,418 endpoints · 30 days
Sources: EDR, SIEM, 4104, AMSI, DNS, proxy

OUTLOOK.EXEPID 5080 · attachment

→

WINWORD.EXEPID 7744 · macro

→

powershell.exePID 8120 · encoded

→

in-memory stageScript block 3/3

→

schtasks.exePID 8468 · persistence

Artifact	Sanitized value	Observation	Assessment
PowerShell command	1,840 encoded characters	Hidden; noninteractive	No peer baseline match
Download domain	`cdn-sync.invalid`	First-seen; 6 queries	Reserved replacement
Second-stage SHA-256	`c027…e114`	286 KB response	Unique enterprise-wide
Scheduled task	`BrowserUpdateCheck`	Runs every 30 minutes	Masquerading persistence

Visual investigation brief

Original detection

EDR alert · rule v6.4

Alert IDEDR-PS-8821

Detected14:22:34 UTC

RuleOffice spawning encoded PowerShell

HostWKSTN-HR-118

Command length1,840 characters

Initial severityMedium · 68/100

Investigation funnel

1,864 → 1

1,864Endpoint events reviewed

63Related process/script events

19PowerShell events

9Corroborating signals

1Confirmed incident

Evidence confidence matrix

Cross-source support

Finding	Endpoint	Script / AMSI	Network	Confidence
Malicious document chain	✓	✓	—	Confirmed
Payload download	✓	✓	✓	Confirmed
Memory execution	Context	✓	—	High
Persistence	✓	✓	—	Confirmed
Credential theft / exfiltration	None	None	None	Not observed

Initial alert

Suspicious command line

Office → PowerShell
Encoded and hidden flags
One endpoint identified
Payload and impact unknown

→

Completed investigation

Six-stage malicious chain

Two payload responses recovered
Memory execution reconstructed
Scheduled persistence confirmed
12,418 endpoints searched

Layered execution chain

14:22:31–14:24:18

Document openedbenefits-review.docm
14:22:31

Encoded launcherPowerShell · 1,840 chars
14:22:34

Remote retrieval4.2 KB bootstrap
14:22:36

String reconstructionScript block 2/3
14:22:38

Memory invocation286 KB module
14:23:02

PersistenceScheduled task
14:24:18

Multi-source timeline

14:22–14:34 UTC

Endpoint

Script 4104

DNS / Proxy

Task

Response

14:2214:2514:2814:3114:34

Evidence that changed the verdict

Suspicious parentage

A word-processing application spawned PowerShell with hidden-window and encoded-command flags—absent from the user’s 30-day baseline.

Recovered script block

Logging showed a downloader, string reconstruction, and in-memory invocation. The command content had no administrative business purpose.

External infrastructure

DNS and proxy telemetry tied the process to a newly registered domain with no prior enterprise prevalence.

Persistence attempt

The chain created a scheduled task masquerading as browser maintenance and referencing a user-profile script.

Correlated timeline

14:22:31 · Document opened

Email attachment opened by the targeted user.

14:22:34 · PowerShell launched

Hidden encoded command starts beneath the document process.

14:22:36 · Stage two downloaded

PowerShell resolves and contacts a first-seen domain.

14:23:02 · Memory execution

Recovered script block invokes reconstructed code without writing the final payload to disk.

14:24:18 · Persistence created

Scheduled task registered under a misleading maintenance name.

14:33:20 · Host isolated

Host isolated; task removal and token revocation initiated.

Competing hypotheses tested

Hypothesis	Test	Disposition
Legitimate login or deployment script	Compared parent process, signer, command-line pattern, domain age, and management records.	Rejected: no management job or approved script matched.
Benign document automation	Checked document macros and expected child processes against peer activity.	Rejected: encoded hidden PowerShell and network retrieval were anomalous.
Malicious staged downloader	Joined process ancestry, script blocks, DNS, proxy, and persistence telemetry.	Confirmed.

Confirmed scope and uncertainty

Confirmed by evidence

Macro, encoded PowerShell, download, memory execution, and task creation occurred on one host.
Two HTTP 200 responses delivered 4.2 KB and 286 KB.
Three script blocks reconstruct the observed chain.
No matching indicators appeared on 12,418 peers.

Not yet confirmed

The final in-memory module was only partially recovered.
No evidence establishes credential access, lateral movement, or data theft.
The delivery path before the mail gateway remains unknown.
No named-family or actor attribution is made.

Containment and follow-up

Isolate and collect

Preserve script-block logs, PowerShell operational logs, memory, task XML, document, and browser artifacts.

Remove persistence

Disable the scheduled task and quarantine all staged scripts and the originating document.

Block and hunt

Block the infrastructure and search for process ancestry, command patterns, task name, and DNS indicators.

Strengthen controls

Enforce script-block logging, constrained language where applicable, and document-origin protections.

Technical evidence and response

PowerShell telemetry correlation

One chain · five sources

Time UTC	Source	Record	Observation	Contribution
14:22:34.114	EDR	ProcessCreate	WINWORD → hidden powershell	Suspicious ancestry
14:22:34.307	PowerShell	4104 / 78102	Encoded launcher decoded	Intent established
14:22:36.051	DNS	Query	cdn-sync.invalid first seen	Infrastructure joined
14:22:39.884	Proxy	HTTP GET	286 KB response	Payload transfer
14:23:02.440	AMSI / 4104	Script block 3/3	In-memory invocation	Execution confirmed
14:24:18.702	Security log	4698	Scheduled task created	Persistence confirmed

Download waterfall

Sanitized network evidence

14:22:36GET /bootstrap200

4.2 KB · loader

14:22:39GET /content200

286 KB · module

14:23:06POST /status204

0.8 KB · check-in

Script block 1 · 14:22:34

Environment and launcher

[encoded launcher redacted] → hidden execution contextRecord 78102 · 1,126 characters

Script block 2 · 14:22:38

Retrieval and reconstruction

[sanitized web request] → byte-array reconstructionRecord 78105 · 2,804 characters

Script block 3 · 14:23:02

Memory and persistence

[in-memory invocation] → scheduled-task definitionRecord 78111 · 3,422 characters

Baseline comparison

12,418 endpoints · 30 days

Attribute	Incident	Enterprise baseline	Interpretation
Word → PowerShell	Present	0 occurrences	Highly anomalous
Encoded PowerShell	Present	14 approved occurrences	Not conclusive alone
Hidden window	Present	3 approved occurrences	Rare but explainable
First-seen domain	Present	0 approved occurrences	Strong corroboration
Task after document	Present	0 matching chains	Malicious sequence

Process queryParent = WINWORD · Child = PowerShell

EDR · 30d1 host

Script queryScriptBlockHash = c027…e114

SIEM1 host

Persistence queryTaskName = BrowserUpdateCheck

Security 46981 host

Impact queryCredential access · SMB · RDP · upload

24h review0 matches

Negative evidence reviewed

Absence tested—not assumed

Question	Sources / window	Result	Meaning
Did the chain execute elsewhere?	EDR + 4104 · 12,418 hosts · 30d	0 additional	Scope remains one host
Did credential access follow?	EDR memory-access telemetry · 24h	0 matches	Credential theft not observed
Was lateral movement attempted?	SMB, RDP, WinRM, service creation · 24h	0 matches	No confirmed lateral movement
Was data uploaded?	Proxy + DNS · 24h	Only 0.8 KB check-in	No material exfiltration observed

Response status

Closing review

Endpoint isolatedComplete · 14:33

Scheduled task removedComplete · 14:39

User tokens revokedComplete · 14:41

Enterprise huntComplete · 12,418

Memory capability analysisPartial

Pre-gateway delivery pathUnknown

Evidence ledger

Sanitized chain of evidence

ID	Source	Event UTC	Collected	Entity	Verdict contribution
P-01	EDR	14:22:34	14:22:35	powershell.exe	Alert and ancestry
P-02	PowerShell 4104	14:22:34	14:22:36	Script block 1	Launcher recovered
P-03	Proxy	14:22:39	14:22:51	286 KB response	Download confirmed
P-04	AMSI	14:23:02	14:23:04	Memory stage	Execution corroborated
P-05	Security 4698	14:24:18	14:24:20	Scheduled task	Persistence confirmed

MITRE ATT&CK mapping

Technique	Observed behavior
T1204.002 · Malicious File	User opened the weaponized attachment.
T1059.001 · PowerShell	Encoded hidden PowerShell execution.
T1105 · Ingress Tool Transfer	Second-stage content retrieved from external infrastructure.
T1027 · Obfuscated Files or Information	Encoded command and reconstructed strings.
T1053.005 · Scheduled Task	User-context persistence through a misleading task.