EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.

What the interviewer wants to hear

• Read and decode the full command line
• Check the parent process and how it started
• Look at network connections, file writes and child processes
• Check user context and similar activity on other hosts
• Decide, contain and document

Model answer

I start with the full command line. If it uses -EncodedCommand, I decode the Base64 as UTF-16LE in CyberChef and peel off further layers, and I check PowerShell script block logs (Event 4104) for the real script. Then I look at the process tree. PowerShell launched by Word, Outlook or a browser points to phishing, while one launched by a known management tool may be legitimate. Next I check what it did: network connections, files dropped, child processes and any persistence. I also confirm the user and whether they were active, and search the SIEM for the same command or hash on other hosts. If it is malicious, I isolate the host, block indicators, reset credentials if needed and document everything clearly for escalation.

More medium Cybersecurity Analyst questions

• Walk me through how you triage a new SIEM or EDR alert.
• You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
• What is MITRE ATT&CK and how do you use it in your work?
• You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
• Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
• How do you write an incident report that works for both technical teams and non-technical leaders?
• A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
• How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
• A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?