Your submitted response
933 wordsIncident: INC-CYB-USB17 · SEV-3 / P3
Status: Investigating — endpoint containment in progress
Classification: Cybersecurity · Suspicious USB Device · PowerShell Downloader · Credential Theft Attempt
Affected asset: RECEPT-WS-01 · Reception desk Windows workstation · Medium criticality
Detected: 2026-04-19 16:08 UTC
SITUATION & SUMMARY
EDR generated an alert for suspicious removable media execution on RECEPT-WS-01, the reception desk workstation. A USB mass storage device labeled Q2_BONUS was inserted at 16:01 UTC. The device contained Q2_Bonus_List.lnk, .hidden\stage1.ps1, and README.txt.
At 16:03 UTC, the workstation executed a Windows shortcut file from the USB device. The shortcut launched powershell.exe with -nop -w hidden -enc, indicating an encoded, hidden PowerShell command. The decoded stage one script attempted to download and execute a second-stage PowerShell payload from cdn-doc-share[.]xyz. It also attempted an LSASS memory dump using rundll32 comsvcs.dll MiniDump, which indicates a credential-theft attempt.
EDR blocked outbound communication to cdn-doc-share[.]xyz, and the domain is low reputation and only 8 days old. The stage one script hash is detected by 41/72 AV engines as a PowerShell downloader. At this time, there is no confirmed evidence of successful second-stage download or data exfiltration, but the endpoint should be treated as potentially compromised until triage is complete.
SEVERITY & PRIORITY
This is rated SEV-3 / P3 because the affected workstation is medium criticality, EDR appears to have blocked outbound communication, and there is no confirmed exfiltration at this time.
However, containment should be handled urgently because the USB-launched script attempted credential theft through LSASS dumping. Even a reception workstation may contain cached credentials, shared-user tokens, browser sessions, VPN artifacts, or access to internal systems.
IMMEDIATE CONTAINMENT
Isolate RECEPT-WS-01 from the network using EDR network containment or physically disconnect it if EDR isolation is unavailable.
Instruct the receptionist to stop using the workstation immediately.
Preserve the USB device as physical evidence. Do not plug it into another corporate workstation.
Block cdn-doc-share[.]xyz at DNS, proxy, firewall, and EDR network controls.
Add detections for the USB volume label Q2_BONUS, files Q2_Bonus_List.lnk and .hidden\stage1.ps1, the stage one SHA256 a14f..be07, and the PowerShell command pattern using -nop -w hidden -enc.
Confirm whether EDR blocked the PowerShell process only at network egress or also blocked local execution activity.
Begin endpoint triage on RECEPT-WS-01 before reimaging.
ENDPOINT INVESTIGATION
Pull the full EDR process tree for explorer.exe → powershell.exe.
Decode and preserve the full PowerShell command and stage one script.
Determine whether the LSASS dump attempt succeeded and whether %TEMP%\l.dmp or any similar dump file exists.
Search for execution artifacts, including Prefetch, Amcache, Shimcache, PowerShell operational logs, Windows Event Logs, and EDR telemetry.
Check whether any files were written, scheduled tasks created, registry run keys modified, services installed, or additional scripts dropped.
Review network telemetry to confirm whether any connection to cdn-doc-share[.]xyz succeeded before the block.
Check whether the workstation accessed any other suspicious domains or IPs after USB insertion.
Identify the logged-in user at the time of execution and determine whether any credentials, tokens, browser sessions, or shared accounts may have been exposed.
SCOPE / HUNTING
Search EDR and removable media logs for the same USB device VID/PID, volume label Q2_BONUS, or files across all endpoints.
Search for the same stage one hash a14f..be07 across the environment.
Search for PowerShell executions with -nop, -w hidden, and -enc across endpoints in the last 7 days.
Search DNS/proxy/firewall logs for any access to cdn-doc-share[.]xyz.
Ask Office Operations and Facilities whether any similar USB devices were found in the lobby, conference rooms, parking areas, or reception area.
Review lobby CCTV if available to determine who left the USB device.
EVIDENCE PRESERVATION
Preserve the physical USB device in an evidence bag or controlled evidence location.
Photograph the USB device, label, workstation location, and any visible packaging or notes.
Preserve EDR alert details, process tree, command line, file hashes, and remediation status.
Preserve the LNK file, stage one script, and README.txt in a malware-analysis evidence repository.
Preserve network logs showing the attempted connection to cdn-doc-share[.]xyz.
Preserve Windows event logs and PowerShell logs from RECEPT-WS-01.
If policy requires, capture a forensic disk image or targeted forensic collection before reimaging.
RECOVERY & NEXT STEPS
Complete endpoint triage before returning RECEPT-WS-01 to service.
If LSASS dumping succeeded or compromise cannot be ruled out, reset passwords and revoke sessions for any users who logged into RECEPT-WS-01.
Reimage or rebuild the workstation after evidence collection if malicious execution is confirmed or endpoint integrity cannot be trusted.
Confirm the rebuilt workstation is fully patched, EDR protected, and configured to restrict removable media execution.
Review removable media policy for public-facing workstations.
Disable AutoRun/AutoPlay where applicable and enforce controls blocking execution from removable media.
Provide a targeted reminder to reception and office staff: found USB devices should be turned over to IT/Security and never plugged into workstations.
STAKEHOLDER COMMUNICATION
Notify Office Operations that the reception workstation is under containment and may be temporarily unavailable.
Notify Endpoint Security to begin forensic triage and enterprise hunting.
Notify Facilities/Security to look for additional suspicious USB devices and review relevant CCTV.
Notify IT Operations if a temporary replacement workstation is needed for reception coverage.
DO NOT
Do not plug the USB device into another workstation to inspect it.
Do not let the receptionist continue using RECEPT-WS-01 during investigation.
Do not simply delete the LNK/script and close the alert.
Do not reboot or reimage before preserving key EDR, Windows, PowerShell, and file evidence.
Do not assume EDR fully prevented compromise until the LSASS dump attempt and process activity are reviewed.
Do not send malware samples through email or chat.
Do not blame the receptionist as the response action; treat this as a social-engineering and endpoint-control incident.