PowerShell transcript logs and Windows Event logs can be checked to identify malicious hosts; the user agent string and IP addresses can also be used for this purpose.

PowerShell transcript logs and Windows Event logs can be checked to identify malicious hosts; the user agent string and IP addresses can also be used for this purpose.

• A. Internal Reconnaissance
• B. Use of Command-Line Interface Detection
• C. HTTP User Agent
• D. Use of PowerShell Detection

Answer: (D)

Detecting PowerShell usage. The statement points to sources that specifically reveal PowerShell activity—PowerShell transcript logs and Windows Event logs capture what commands were run, which scripts were loaded, and how PowerShell was used. That visibility is exactly what defenders rely on to spot malicious hosts trying to leverage PowerShell for intrusion, lateral movement, or payload download. The mention of the user agent string and IP addresses complements this by providing network indicators that can appear in PowerShell-driven web requests or remoting activity, helping to correlate host activity with external signals. While broader concepts like internal reconnaissance or general CLI usage can be part of attacker behavior, the scenario described hinges on PowerShell-focused logs and indicators, making PowerShell detection the best fit. The HTTP User Agent angle is related to web traffic patterns but is not the primary source of the PowerShell activity described, so it’s less aligned with the given logs.

Detecting PowerShell usage. The statement points to sources that specifically reveal PowerShell activity—PowerShell transcript logs and Windows Event logs capture what commands were run, which scripts were loaded, and how PowerShell was used. That visibility is exactly what defenders rely on to spot malicious hosts trying to leverage PowerShell for intrusion, lateral movement, or payload download. The mention of the user agent string and IP addresses complements this by providing network indicators that can appear in PowerShell-driven web requests or remoting activity, helping to correlate host activity with external signals.

While broader concepts like internal reconnaissance or general CLI usage can be part of attacker behavior, the scenario described hinges on PowerShell-focused logs and indicators, making PowerShell detection the best fit. The HTTP User Agent angle is related to web traffic patterns but is not the primary source of the PowerShell activity described, so it’s less aligned with the given logs.