Alert chapter quiz

Baseline comparison is one of three strategies; the baseline it reads is one of four context dimensions. A single dimension agreeing is not the same as validation. The environmental dimension says the timing is consistent; technical fidelity, threat intelligence, and business impact have not been checked yet. Validate across all four, then decide.

Criticality validation is exactly the strategy designed for this trade-off. Alert B affects a high-criticality asset and a privileged identity, so it is the immediate-action alert. Months later, the criticality data attached to the queue order is what makes the choice reviewable in a post-mortem.

Every binary in the chain is signed and individually unremarkable, so hashes match nothing bad and single events sit inside tolerance. What is detectable is the sequence — the parent-child chain and its context. And the family label is honestly plural here: a deterministic Sigma-style rule that encodes that chain is rule-based by construction and behavioral by content. Name both when both apply; what matters for triage is reading the logic that fired, not picking its one true family.

This is the trust-calibration posture from the detection-mechanisms page. The mechanism label sets a prior, not a verdict: an exact indicator match starts with the higher prior because it is precise about the artifact, but converting that prior into confidence requires the calibration facts — is the indicator fresh, from a credible source, and rare in this environment, or is it a stale hash on a dual-use tool? The anomaly is genuine but ambiguous signal that almost always needs corroboration. Treating the two alerts identically throws away provenance; treating the signature label as proof skips the rule-reading the label is supposed to prompt.

Single signals get tuned out as noise. The combination is what changes the verdict. New domain + an unusual process for the user + no documented business reason maps to the classic certutil-as-LOLBin pattern. None of the signals on its own is decisive. The combination is.

-EncodedCommand takes a Base64-encoded UTF-16LE string, an encoding, not encryption, so it decodes locally with no key. The surrounding flags (-nop, -w hidden, abbreviated names) raise suspicion, and legitimate automation does use -enc, which is exactly why the decoded payload, not the flag, decides. Here it opens with IEX (New-Object ..., the classic download-and-execute-in-memory prefix.

explorer.exe launching Word is a user double-click, normal. And once msdt.exe runs, sdiagnhost.exe is its expected child. The break in the story is the middle link: a word processor has no business spawning the Microsoft Support Diagnostic Tool, and that parent-child pair is the signature of the Follina exploit (CVE-2022-30190). Every node being signed by Microsoft is exactly why lineage, not identity, is what you parse.

4688 does have a CommandLine field, but populating it requires the 'Include command line in process creation events' policy, which is off by default. If it was never enabled, every historical event is blank and no retroactive fix exists, a telemetry gap you discover exactly when you need the data. Sysmon Event 1 is the common compensating source. This is why parsing includes knowing what your telemetry was configured to capture.

Alert produces three deliverables: the validated alert (detection-mechanism analysis, structured data, validation results, telemetry correlation), the leads for Subject and Uncover (baseline anomalies, spotted correlations, intel hits, temporal anchors), and the flags for Scope, Risk, and Escalation. Only the first is finished work; the other two are honest lead lists. Verdicts and containment are downstream phases. Reports are documentation. The Alert phase's job is to make the next analyst's work fast and accurate, not to draw conclusions.