A SOC analyst reviews EDR telemetry and sees a PowerShell process spawned by Microsoft Word, then a network connection to an unfamiliar external IP. Which MITRE ATT&CK technique best describes the initial pattern?

• AT1078 Valid Accounts
• BT1059.001 Command and Scripting Interpreter: PowerShell, often invoked via T1566 Phishing or T1137 Office Application Startup
• CT1490 Inhibit System Recovery
• DT1003 OS Credential Dumping