WS-017, a domain-joined workstation, raises an alert after powershell.exe starts under an unusual account. Initial triage confirms suspicious scripting but stops there, missing a persistence mechanism that survives after the PowerShell process exits. The attacker did not need a new vulnerability on the workstation. They needed a usable domain account and a way to make one host execute their action.
The defender’s question is whether the PowerShell alert was an isolated execution event or one step in a larger sequence. Over the next seven lessons, we will turn the records left on WS-017 into a defensible timeline, identify what changed, and decide what response the evidence supports. A defensible finding names the host, account, action, time, and artifact that support the conclusion rather than relying on an alert label.
The simplest case is an execution event showing ACME\svc_backup launching powershell.exe on WS-017 at 09:24. That record establishes that a process started under that principal. It does not establish how the account reached the host, what script ran, whether persistence was created, or whether the process succeeded. Each later artifact answers one of those narrower questions.
Investigation rule
Treat every alert as a starting point. Corroborate its claim with host-specific evidence before declaring scope, cause, or impact.
To prevent unrelated records from becoming a false narrative, every lab uses the same fixed boundaries. The host is WS-017, joined to the ACME.LOCAL domain. Its expected interactive user is ACME\j.smith. The suspicious principal is ACME\svc_backup, a service account whose use on a user workstation requires explanation. The incident window is 2026-09-14 from 09:10 through 10:05 local time.
Those constants let us correlate evidence without assuming that every event is malicious. A Security log record can identify a principal through fields such as SubjectUserName and identify the kind of session through LogonType. A process image path, a registry path, and a service configuration all become meaningful only when tied back to WS-017 and this time window. If a record names another host or falls outside the window, we retain it only when evidence establishes a direct relationship.
The local Administrators group is a critical boundary in this case. ACME\j.smith should operate as a standard user, while actions performed by ACME\svc_backup may carry administrative authority. The same executable has a different investigative meaning when it runs under an account that can install services, write system-wide registry keys, or alter security settings.
The case boundary connects the domain identity, local privilege boundary, and incident window in one view:
This diagram fixes the scope for every later question. We investigate activity on WS-017 during the stated 55 minutes, then expand only when an artifact points beyond that boundary.
Once the case scope is fixed, evidence sources should be chosen for the question they can answer, not because one log channel feels more authoritative. Windows Event Log records operating-system and security activity, while Sysmon adds detailed endpoint telemetry when configured. The registry preserves configuration that can outlive a process. No single source proves the whole sequence.
For WS-017, later labs will use four evidence families:
Microsoft-Windows-Sysmon/Operational to connect process creation, network activity, file creation, and registry changes when Sysmon recorded them.Microsoft-Windows-PowerShell/Operational to determine what PowerShell logged about scripting activity.HKLM and HKCU registry hives to inspect machine-wide and user-specific configuration changes.A System event such as 7045 records that the Service Control Manager installed a service, including its service name, image path, start type, and service account. On its own, 7045 proves service creation, not malicious intent. We must compare the path and account to expected administration, then correlate nearby logons and process evidence. If a service was created but its executable path was not collected or the relevant audit source is absent, the investigation has a blind spot that must remain explicit.
The evidence sources differ in coverage, fields, and failure modes: