Problem Statement
A SIEM fired a high-confidence alert for suspicious PowerShell. What should be your first move?
Explanation
Great responders trust but verify. Pull the command line, script block logs if available, parent process, user context, and recent login activity. Quick validation prevents false positives from causing outages, and guides the right containment step if it is real.
