Synthetic demo case · C-0001
Office document to encoded PowerShell
The supplied records show Office launching encoded PowerShell and a scheduled-task command. Whether the decoded payload or the task ran is not established by those process records.
- Evidence
- Microsoft Defender for Endpoint export (CSV)
- Findings
- 3 (highest severity high)
- Events
- 22
- Stated unknowns
- 12
Findings and citationsClient reportDefender export analysisAll demo cases