Suspicious PowerShell: Support Diagnostic

Follow the evidence. Build your hypothesis. Make the call.

● Investigation active

Follow the thread.

Each discovery leaves a trace.

Start with what you know

INITIAL ALERT

FIN-WS042

Suspicious PowerShell

2026-09-13 12:41:08 UTC
Computer: FIN-WS042
User: CORP\m.roberts

Image:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

CommandLine:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\m.roberts\AppData\Local\Temp\TeamsSupport\Collect-Diagnostics.ps1"

ProcessId: 6844
ParentProcessId: 5312
IntegrityLevel: Medium

WHERE TO LOOK

Sysmon Event ID 1 · Windows Security 4688 (command-line auditing enabled) · EDR process telemetry · SIEM

NEXT STEP

Suspicious PowerShell: Support Diagnostic

Follow the thread.

Suspicious PowerShell

What do you investigate next?