Help Desk Incident Response: Isolating a Phishing Payload

Incident Timeline

• 09:14 AM EST: An operator clicked an unexpected invoice attachment link.
• 09:22 AM EST: Help desk received alerts noting unusual system execution spikes.

Triage Analysis

Leveraged Sysinternals Process Explorer to map parent-child application links. Discovered an active macro payload spawning an unauthorized sub-process out of a temporary storage directory:

explorer.exe -> excel.exe -> cmd.exe -> powershell.exe