CCDL1

Practice session

A Windows Security Event log shows Event ID 4688 with a process named 'powershell.exe' spawned by 'winword.exe'. Which attack technique does this most likely indicate?

Loading your practice session…