A SOC analyst reviews EDR telemetry and sees a PowerShell process spawned by Microsoft Word, then a network connection to an unfamiliar external IP. Which MITRE ATT&CK technique best describes the initial pattern?

Free until March 2027 while we learn what predicts passing.