An EDR solution reports that a process (winword.exe) spawned a child process (cmd.exe) which then ran 'powershell.exe -nop -w hidden -enc <base64>'. What attack technique is most likely being executed?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when Word spawns cmd.exe and then PowerShell with -nop -w hidden -enc, you're seeing a malicious Office macro run encoded PowerShell, which is a classic spear-phishing technique.
Full Explanation
The spear-phishing attack using a malicious Office macro to execute encoded PowerShell is correct because the process chain of Word spawning cmd.exe and then PowerShell with -nop -w hidden -enc flags is the classic signature of a malicious Office macro executing encoded PowerShell payloads, commonly used in spear-phishing campaigns (MITRE T1566.001 + T1059.001). The normal macro-enabled Word document running an automated business process is wrong because legitimate macros do not typically spawn hidden encoded PowerShell; this pattern is a well-known malicious indicator. The Windows Update process triggered by an Office update check is wrong because Windows Update processes are initiated by svchost.exe or WaasMedic, not Word. The legitimate Office automation task using COM objects is wrong because COM automation does not require encoded hidden PowerShell executions through cmd.exe.