An EDR solution reports that a process (winword.exe) spawned a child process (cmd.exe) which then ran 'powershell.exe -nop -w hidden -enc <base64>'. What attack technique is most likely being executed?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the process chain of Word → cmd.exe → PowerShell with -nop -w hidden -enc flags is the classic signature of a malicious Office macro executing encoded PowerShell payloads, commonly used in spear-phishing campaigns (MITRE T1566.001 + T1059.001). A is wrong because legitimate macros do not typically spawn hidden encoded PowerShell; this pattern is a well-known malicious indicator.
Full explanation below image
Full Explanation
B is correct because the process chain of Word → cmd.exe → PowerShell with -nop -w hidden -enc flags is the classic signature of a malicious Office macro executing encoded PowerShell payloads, commonly used in spear-phishing campaigns (MITRE T1566.001 + T1059.001). A is wrong because legitimate macros do not typically spawn hidden encoded PowerShell; this pattern is a well-known malicious indicator. C is wrong because Windows Update processes are initiated by svchost.exe or WaasMedic, not Word. D is wrong because COM automation does not require encoded hidden PowerShell executions through cmd.exe.