Immersive Labs – APT29: Threat Hunting with Splunk

Hi everyone,

I’m currently working through the Immersive Labs – APT29: Threat Hunting with Splunk lab and got stuck on Question 10.

Question:

A PowerShell script was initially executed to extract encoded data from an image file. What is the full ParentCommandLine field value used to execute this?

What I’ve tried so far:

• Searched PowerShell logs (EventCode 4103 / 4104) in Splunk
• Looked for base64/encoded content indicators (e.g., FromBase64String, -enc, IEX)
• Filtered for image-related activity (e.g., .jpg, .png)
• Reviewed process creation context but struggling to identify the exact ParentCommandLine.

Appreciate any guidance—trying to understand the hunting logic, not just the answer.

Thanks in advance!