Summary & Initial Findings

Suspicious PowerShell execution detected on Host FIN-W10-092 followed by file encryption and .locked extension appending.

Recommended Action Items

• Isolate affected host machine from domain network.
• Revoke active session tokens for compromised user account.
• Block C2 IP addresses in gateway firewall policy.