Field guide / Reviewed October 31, 2026

Read the process chain before the conclusion.

PowerShell is used for legitimate administration and abuse. The name of the interpreter does not distinguish the two.

Anchor the alert to an actual event.

Record the detection reason, host, account, event time and process-event reference. In your approved endpoint tooling, inspect the captured command line, parent process, child processes and related events. Do not run a command copied from an alert. CaseNote deliberately has no execution or decoding button.

Elastic's investigation workflow supports moving from an alert to related events and process context, then retaining findings in notes and cases. The workflow is useful even when your team's tools differ. Elastic investigation workflow.

Check whether script evidence exists.

For PowerShell 7.5 on Windows, Microsoft documents script-block logging and event 4104 in PowerShellCore/Operational when the relevant logging is enabled. The documentation distinguishes this from Windows PowerShell 5.1. Record edition, version, channel and collection coverage instead of assuming that every host has equivalent logs. Microsoft PowerShell 7.5 logging reference.

If the relevant channel is missing from your export, write “script evidence unavailable in supplied records.” Do not write “no scripts ran.” Logging configuration, collection and retention all affect what you can observe.

Distinguish a command from its effects.

A captured command line can support a statement about what was requested. Separate records are needed for claims about a file written, connection completed or setting changed. Preserve those references as separate evidence entries.

Synthetic E1: Training process P1 records pwsh.exe as a child of a document viewer under user-07.

Synthetic E2: Training process P2 records process exit. The supplied records include no file, network or script-block events.

Defensible conclusion: The process relationship needs investigation. Effects and intent are not established.

Test an ordinary explanation, too.

Ask whether a documented integration, deployment job or scheduled administration explains the exact process chain and time. An approved script with a different parent, account or time is not automatically an explanation for this event.

Useful escalation: “Can the endpoint owner retrieve the command line and script-log coverage for this process, then correlate any resulting file or network activity? No containment was performed during this review.”

Follow the local playbook if immediate response is required. Do not delay an urgent escalation to complete every field. Open the worksheet and select Suspicious PowerShell.