Cybersecurity ← Knowledge Base
Suspicious PowerShell Activity / Endpoint Alert
Problem
Endpoint security software flags unusual PowerShell activity on a device.
Symptoms
- EDR/antivirus alert referencing PowerShell
- Encoded or obfuscated command line in the alert
- PowerShell launched by an unexpected parent process (e.g. a Word document)
Possible Causes
- Legitimate admin scripting incorrectly flagged (false positive)
- A malicious macro or document launching PowerShell to download further payloads
- Living-off-the-land technique using PowerShell for post-exploitation
Diagnostic Steps
- Review the full command line in the alert, including any encoded (-EncodedCommand) portions
- Check what process launched PowerShell — a legitimate admin task, or an office document/browser?
- Check PowerShell script block logging / transcript logs for full context if enabled
- Correlate with the user's recent activity — did they open an email attachment or download something just before?
Commands & Tools
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" (admin, review logs)Isolate the endpoint via EDR console before further investigation if malicious activity is confirmed
Step-by-Step Solution
- If confirmed malicious: isolate the endpoint from the network immediately
- Preserve logs and any relevant files before remediation begins
- Identify and remove the persistence mechanism (scheduled task, registry run key, startup script)
- Rotate credentials that were active on the compromised device
- If confirmed a false positive from legitimate admin activity, document and tune the detection rule to reduce future noise
Verification
The endpoint is confirmed clean via a full scan, no persistence mechanisms remain, and the account's credentials have been rotated if warranted.
Common Mistakes
- Dismissing the alert as a false positive without actually reviewing the command line
- Remediating before preserving logs, losing evidence needed for a full investigation
- Not checking for persistence after removing the immediate process
Escalation Criteria
Escalate to incident response immediately on any indication of real compromise — do not attempt full remediation alone if the scope is unclear.
Prevention
Enable PowerShell script block logging, apply application control /constrained language mode where feasible, and restrict script execution policy appropriately.