# PowerShell Attack Investigation (lab)

> A freight company's Accounts Payable clerk reports that an invoice attachment opened "oddly" and a window flashed on screen.

Canonical: https://codelivly.com/labs/powershell-investigation

| | |
|---|---|
| Type | Investigation |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 45 min |
| Completions | 2 |

A freight company's Accounts Payable clerk reports that an invoice attachment opened "oddly" and a window flashed on screen. The estate runs encoded PowerShell all day long, so the alert that fired is useless on its own. Reconstruct the process tree and find what ran.

## Objective

Learn to investigate PowerShell abuse the way it actually presents in a managed Windows estate: as one edge in a process tree rather than one suspicious string. You will group Sysmon process creations by parent, decode a base64 UTF-16LE command by hand, correlate script-block logging with process creation and file-write events, and separate a real intrusion from deployment tooling that looks far worse than the attack does.

## Tasks

1. Read the brief, then measure the noise
2. Group process creations by their parent
3. Identify the host, the account and the moment
4. Decode the command
5. Separate downloading from downloading somewhere bad
6. Follow the payload and map the activity

## Related

- [All labs](https://codelivly.com/practice?type=lab)