Which detection category would monitor PowerShell transcript logs and Windows Event logs to identify malicious hosts?

• A. Internal Reconnaissance Detection
• B. Use of Command-Line Interface Detection
• C. Unspecified Proxy Activities Detection
• D. Use of PowerShell Detection

Answer: (D)

PowerShell is a powerful tool that attackers frequently abuse to run commands, download payloads, and move laterally. By collecting PowerShell transcript logs and Windows Event logs, you get detailed visibility into exactly what commands were executed, with parameters and script content, and in what order. This makes it easier to spot suspicious patterns such as encoded or obfuscated commands, unusual invocation chains, or remote script execution. Since the focus is on monitoring PowerShell activity specifically, this detection approach provides precise telemetry to identify potentially compromised hosts, rather than just general command-line use or unrelated network activity. Other categories would monitor broader behaviors like reconnaissance or proxy traffic, which don’t directly capture PowerShell abuse.