CSA (312-39) SOC Simulation Lab

In this lab, you will analyze remote PowerShell execution via Windows Remote Management (WinRM). You'll learn how to identify lateral movement techniques and use Process Creation events to scope a potential breach.

Scenario Context

You are a Tier 3 SOC Analyst. It is 2:00 AM on a Saturday. An L2 analyst has escalated a high-severity alert triggered on DC-01 (your primary Domain Controller). The EDR platform flagged anomalous PowerShell activity.

The alert indicates that winrm.exe spawned an instance of powershell.exe bypassing execution policies. You need to determine the immediate next step to understand the scope and intent of this activity before authorizing server isolation.

Security Environment

You pivot to your SIEM and pull the raw telemetry that triggered the initial EDR alert:

[System: Splunk Enterprise Security] -> Query: index=windows EventID=4688 Computer="DC-01*" RESULTS: 1 match found. LogName=Security SourceName=Microsoft-Windows-Security-Auditing EventCode=4688 Keywords=Audit Success ComputerName=DC-01.corp.local New Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Creator Process Name: C:\Windows\System32\wsmprovhost.exe Parent Process Command Line: C:\Windows\System32\svchost.exe -k DcomLaunch Process Command Line: powershell.exe -ExecutionPolicy Bypass -NoProfile -EncodedCommand JABz...[TRUNCATED]

Note: wsmprovhost.exe is the provider host process for WinRM.

Question

A SOC analyst detects multiple instances of powershell.exe being launched with the ExecutionPolicy Bypass and -NoProfile arguments on a domain controller. The parent process is winrm.exe, and the activity occurs during non-business hours. What should be the analyst's primary focus?
Analyst Hint: You know an execution occurred. The immediate goal of Incident Response scoping is to find out exactly what commands were run and if this payload was executed on any other machines in the network. Which event ID tracks process command lines?

Expert Insight

1. What is happening

An attacker has likely compromised an administrative credential (or hash) and is using tools like Evil-WinRM or PowerShell Remoting to execute commands interactively on the Domain Controller. The combination of off-hours timing, execution policy bypass, and the -NoProfile flag (used to avoid loading user-specific scripts that might break the payload or generate noise) is a classic signature of lateral movement and malicious post-exploitation activity.

2. Why the correct answer is correct

A. Search for Event ID 4688 to find similar PowerShell executions within the last 24 hours is the immediate priority. Event ID 4688 (Process Creation), specifically when Command Line Auditing is enabled, will show you the exact arguments passed to PowerShell. Searching this globally across your SIEM allows you to decode the base64 payload to determine the attacker's intent (e.g., dropping ransomware, dumping NTDS.dit) and quickly scope which other servers are compromised.

3. Why other options are wrong

B. Look for Event ID 4625: Since WinRM execution succeeded, the attacker already has valid credentials. Looking at failed logons (4625) might show how they got the credentials historically, but it doesn't help you understand the immediate threat payload currently running on the DC.

C. Investigate Event ID 7045: While attackers do create services for persistence, the immediate artifact we have is a process execution. You must investigate the process (4688) first. The PowerShell script might contain the code that creates the service.

D. Review Event ID 5145: Network share access is useful for tracking SMB movement, but this attack is using WinRM (HTTP/HTTPS over ports 5985/5986).

4. Real-world SOC application

When Tier 3 analysts see powershell.exe -ExecutionPolicy Bypass -NoProfile -EncodedCommand, the immediate workflow is to grab the base64 string, drop it into CyberChef, and decode it. By querying Event ID 4688 across the entire environment, you can map the entire attack chain. If you see the exact same 4688 event on 15 different servers, you know you are dealing with a widespread, automated lateral movement campaign, not just an isolated server compromise.

MINI LESSON: Parent-Child Process Analysis (WinRM)

Hunting relies heavily on knowing what is "normal" for your environment.

  • Normal: explorer.exe -> powershell.exe (An admin opened a terminal locally).
  • Suspicious: wsmprovhost.exe -> powershell.exe (Someone is remotely executing PowerShell commands).
  • Highly Malicious: winword.exe -> powershell.exe (A user opened a Word doc that launched a script).

WinRM runs via wsmprovhost.exe. Always monitor child processes spawning from this executable!

Master Incident Response & Threat Hunting

Prepare for your EC-Council CSA with scenario-based labs.

Explore more CSA simulations