Windows Process Execution Triage
A small endpoint-triage exercise using fabricated Windows process events.
Two review candidates, with three nonmatching controls.
The problem
A process command can look suspicious without proving malicious activity. This exercise reviews five fabricated Windows Event 4688 records for encoded PowerShell and certutil download patterns.
What I did
Used a Python analyzer to flag the two command patterns, preserved the source-row context, and compared matches with three benign controls. Mapped the review hypotheses to MITRE ATT&CK.
What I found
The fixture produced two candidates for further review. Parent process, signer, account context, and independent endpoint or network records would be needed to decide whether to escalate.
What the command line does—and does not—tell me
An encoded PowerShell switch and certutil URL-cache arguments are useful review leads. They are not sufficient to determine intent: legitimate administration can use the same tools. The next questions concern the parent process, account, script or payload, execution time and related network activity.
How I would hand off the case
Preserve the original 4688 row, explain the matched command pattern, record the three nonmatching controls and list the missing corroboration. The two synthetic review candidates remain provisional; the fixture contains no recovered payload or confirmed malicious execution.
Academic foundation
Completed coursework: IST 4910 Enterprise Systems Administration and IST 5250 Incident Handling & Cyber Investigation (Fall 2024).
Scope
Fabricated process records and offline rule checks. No real endpoint compromise or live Windows collection is demonstrated.
Read the full analyst report on GitHub ↗