During a routine inspection of system logs, a security analyst notices an entry where Microsoft...

According to theCyberOps Technologies (CBRFIR) 300-215 study guidecurriculum, when analyzing suspicious behavior—especially when scripts or shell commands are executed from applications like Word (which is uncommon)—the encoded PowerShell payload must be decoded to determine if malicious intent is present. Deobfuscation is a critical step in identifying command-and-control behavior, persistence, or malware execution paths.

—