endpoint-incident-response-powershell-trojan

Endpoint Incident Response – Browser-Delivered PowerShell Trojan

Overview

This case study documents a real-world endpoint security incident involving a browser-delivered PowerShell trojan detected by Microsoft Defender.

The threat was successfully contained before execution. The incident was handled following standard SOC / DFIR methodology: detection, triage, containment, verification, persistence hunting, and closure.

---

Incident Summary

• Threat Name: Trojan:PowerShell/Powdow.HCC!MTB
• Severity: Severe
• Detection Tool: Microsoft Defender
• Detection Time: 2026-01-25 23:22
• Status: Contained
• Execution: Prevented

The malicious payload was stored in Firefox browser cache as a compressed (GZip) object and was blocked before execution.

---

Detection

Microsoft Defender raised an alert indicating a PowerShell-based trojan.

Artifact location: C:\Users\AppData\Local\Mozilla\Firefox\Profiles...\cache2\entries

Defender telemetry confirmed:

• DidThreatExecute: False
• IsActive: False

This indicates the payload was intercepted at delivery stage.

---

Initial Triage

Key observations:

• Payload existed only in browser cache
• No executable dropped to disk
• No autoruns detected
• No suspicious processes observed

This suggested a browser-delivered PowerShell stager rather than a persistent compromise.

---

Containment

Actions taken:

• Defender remediation (“Remove”)
• Firefox cache and profile deletion
• Temporary network disconnection
• System reboot
• Follow-up Defender scans

---

Eradication & Verification

Post-remediation checks:

• Windows Defender Quick Scan (clean)
• Persistence hunting:
  • LaunchAgents
  • LaunchDaemons
  • Login Items
• macOS endpoint also inspected for persistence

No malicious artifacts were found.

---

MITRE ATT&CK Mapping

Likely techniques involved:

• T1189 – Drive-by Compromise
• T1059.001 – PowerShell
• T1105 – Ingress Tool Transfer
• T1027 – Obfuscated / Compressed Payload

---

Root Cause

Most likely cause was a malicious web redirect or scripted content delivering a PowerShell downloader, which was cached by Firefox and intercepted by Defender.

---

Outcome

• Execution prevented
• No persistence established
• No impact to system integrity

Incident successfully closed.

---

Lessons Learned

• Browser cache can store active malware payloads
• PowerShell is heavily abused by attackers
• Containment must always precede analysis
• Persistence checks are essential even when execution is blocked

---

Skills Demonstrated

• Endpoint incident response
• Malware triage
• Defender telemetry analysis
• Persistence hunting
• MITRE ATT&CK mapping
• Incident documentation

---

Disclaimer

This case study is for educational and portfolio purposes. Sensitive identifiers have been removed.