Q: 3
An engineer received a report of a suspicious email from an employee. The employee had already
opened the attachment, which was an empty Word document. The engineer cannot identify any
clear signs of compromise but while reviewing running processes, observes that PowerShell.exe was
spawned by cmd.exe with a grandparent winword.exe process. What is the recommended action the
engineer should take?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
