Finance analysts report odd PowerShell activity on a workstation that touches ACH files. Which enterprise capability is best suited to investigate and contain that endpoint behavior?

Suspicious PowerShell on a finance workstation that handles ACH files is an endpoint investigation and containment problem. Endpoint detection and response (EDR), often extended in XDR platforms, records process trees, script activity, network connections, and related telemetry so analysts can determine whether the activity is living-off-the-land abuse, unauthorized automation, or malware, then isolate the host to stop further access to payment files and lateral movement. For municipal finance endpoints, that combination of deep visibility and remote containment is the capability that matches both the investigative need and the urgency of protecting ACH workflows.

A paper visitor log at the building entrance is a physical-security record; it does not capture PowerShell execution or contain a compromised PC. Lengthening password expiration intervals is an authentication hygiene change that neither investigates the current behavior nor stops an already-authenticated session from abusing PowerShell. Disabling building badge readers overnight addresses physical access timing, not endpoint process telemetry or host isolation for a finance workstation.

Exam caveat: EDR containment isolates the host; it does not by itself reverse fraudulent ACH submissions already processed—coordinate with finance operations and fraud procedures. Also distinguish EDR from simple antivirus signature scanning: behavioral and response features are the point here.

Operational check: confirm the finance PC is onboarded to EDR/XDR, that PowerShell logging/script-block telemetry is enabled per policy, that analysts can isolate the host quickly, and that ACH-related file access around the alert window is reviewed in the same investigation.