CCFH

Practice session

A SOC analyst sees a detection where `winword.exe` is the parent of `powershell.exe`, which then spawns `cmd.exe` running an encoded command. Which technique is most likely being used?

Loading your practice session…