Your submitted response
1038 wordsFrom: Incident Response Lead (SOC on-call)
To: IT Leadership · Endpoint Security · Office Operations · On-call SOC
Subject: [SEV-3][INC-CYB-USB01] Malicious USB launched encoded PowerShell on RECEPT-WS-01 — endpoint isolated
Incident: INC-CYB-USB01 · SEV-3 / P3
Status: Investigating — endpoint containment and forensic triage in progress
Classification: Cybersecurity · Malicious USB · PowerShell Downloader · Credential-Theft Attempt
Affected asset: `RECEPT-WS-01` · Medium criticality
Detected: 2026-04-19 16:08 UTC
SITUATION & SUMMARY
EDR detected malicious execution from a removable USB device on the reception workstation `RECEPT-WS-01`.
The USB device, labeled `Q2_BONUS`, contained a deceptive Windows shortcut named `Q2_Bonus_List.lnk` and a hidden PowerShell script at `.hidden\stage1.ps1`. At approximately 16:03 UTC, the shortcut launched `powershell.exe` with hidden-window and encoded-command options.
The decoded script attempted to download and execute an additional PowerShell payload from `cdn-doc-share[.]xyz`. It also attempted to create an LSASS memory dump using `rundll32 comsvcs.dll MiniDump`, indicating attempted credential theft.
EDR blocked outbound communication to the low-reputation domain. The stage-one script is detected by 41 of 72 antivirus engines as a PowerShell downloader. There is currently no confirmed evidence that the second-stage payload was successfully retrieved or that data was exfiltrated. However, local malicious execution occurred, so the endpoint must be treated as potentially compromised until forensic triage is complete.
SEVERITY & PRIORITY
The incident is rated SEV-3 / P3 because the affected workstation is a medium-criticality shared reception endpoint, outbound communication appears to have been blocked, and no successful second-stage execution or exfiltration has been confirmed.
Containment remains urgent because the script attempted to access LSASS credential material. Although privileged information is not intentionally stored on the workstation, cached credentials, browser sessions, authentication tokens, shared-account credentials, or previous administrative sessions may have been exposed.
IMMEDIATE CONTAINMENT
* Isolate `RECEPT-WS-01` from the network using EDR network containment.
* Instruct reception staff to stop using the workstation immediately.
* Secure the `Q2_BONUS` USB device as physical evidence.
* Do not connect the USB device to another workstation.
* Block `cdn-doc-share[.]xyz` at DNS, proxy, firewall, and EDR controls.
* Add the stage-one SHA256 `a14f..be07`, USB volume label, LNK filename, PowerShell command pattern, and domain to enterprise detection and hunting rules.
* Confirm whether EDR blocked only the outbound connection or also terminated the related PowerShell and `rundll32` processes.
* Provide Office Operations with a clean temporary workstation if reception services must continue.
ENDPOINT INVESTIGATION
* Preserve and review the complete EDR process tree beginning with `explorer.exe → powershell.exe`.
* Preserve and decode the complete Base64 PowerShell command.
* Determine whether the second-stage script was downloaded, partially downloaded, or executed before EDR containment.
* Determine whether the LSASS dump command succeeded.
* Search for `%TEMP%\l.dmp`, other memory dumps, and related file-creation events.
* Review PowerShell Operational logs, Windows Security logs, EDR telemetry, Prefetch, Amcache, and other available execution artifacts.
* Search for newly created scheduled tasks, services, registry autorun entries, WMI persistence, startup-folder items, or additional scripts.
* Review all outbound network activity from `RECEPT-WS-01` following USB insertion.
* Identify the user and any administrative accounts that logged into the workstation before or during the incident.
CREDENTIAL EXPOSURE REVIEW
* Determine whether an LSASS dump file was successfully created or accessed.
* Identify all users who logged into `RECEPT-WS-01` during the relevant credential-caching window.
* Review whether helpdesk or administrative personnel previously entered privileged credentials on the workstation.
* If credential access cannot be ruled out, reset affected passwords and revoke active sessions and refresh tokens.
* Rotate local administrator credentials if applicable.
* Prioritize any privileged or shared credentials identified during the review.
SCOPE AND THREAT HUNTING
* Search enterprise removable-media telemetry for USB `VID_0951&PID_1666`, volume label `Q2_BONUS`, and the same device identifiers.
* Search EDR for `Q2_Bonus_List.lnk`, `stage1.ps1`, and SHA256 `a14f..be07`.
* Search for PowerShell executions containing `-nop`, `-w hidden`, and `-enc`.
* Search DNS, proxy, firewall, and EDR telemetry for connections to `cdn-doc-share[.]xyz`.
* Determine whether the same USB device was connected to any other corporate endpoint.
* Ask Facilities and Office Operations to search public areas for similar USB devices.
* Review lobby CCTV, if available, to determine who placed or abandoned the USB device.
EVIDENCE PRESERVATION
* Photograph the USB device, its label, and where it was found.
* Record who discovered, handled, inserted, and subsequently secured the USB device.
* Store the USB device in an approved evidence bag or controlled evidence location.
* Preserve the LNK file, PowerShell script, README file, hashes, and metadata in the approved malware evidence repository.
* Preserve EDR alerts, process telemetry, command lines, remediation records, and network events.
* Preserve relevant Windows and PowerShell logs.
* Perform an approved forensic collection before reimaging if required by incident-response policy.
RECOVERY & NEXT STEPS
* Complete forensic triage before returning `RECEPT-WS-01` to service.
* Reimage or rebuild the workstation if malicious execution is confirmed or endpoint integrity cannot be established.
* Reset credentials and revoke sessions if LSASS access succeeded or credential exposure cannot be ruled out.
* Confirm the rebuilt endpoint is fully patched, enrolled in EDR, and operating normally before reconnecting it.
* Restrict or block execution from removable media on public-facing workstations.
* Review USB storage controls and device-control policy for reception and other shared endpoints.
* Provide targeted awareness guidance instructing employees to deliver found removable media to IT or Security without connecting it.
STAKEHOLDER COMMUNICATION
* Notify Office Operations that the reception workstation has been isolated and may require replacement.
* Notify Endpoint Security to begin forensic triage and environment-wide hunting.
* Notify Facilities and physical security to search for other suspicious USB devices and preserve relevant CCTV footage.
* Notify Identity administrators if credential reset or session revocation becomes necessary.
DO NOT
* Do not plug the USB device into another corporate workstation.
* Do not allow continued use of `RECEPT-WS-01` while triage is in progress.
* Do not assume the endpoint is safe merely because the outbound request was blocked.
* Do not delete the malicious files and close the incident without determining what executed locally.
* Do not reboot, wipe, or reimage the workstation before required evidence is preserved.
* Do not email or upload the malware samples through unapproved channels.
* Do not treat user awareness training as a substitute for technical containment and investigation.