### Overview
Following the detection of a suspicious web shell on the IIS server, further investigation has revealed anomalous PowerShell activities. These activities indicate that the attacker may be attempting to execute scripts remotely to escalate their privileges or install additional payloads.

### Key Indicators
- **PowerShell Execution Logs**: Multiple instances of PowerShell command execution were logged, originating from the compromised server.
- **Obfuscation Techniques**: The commands were heavily obfuscated, a common technique used to evade detection.

### Recommendations
- **Immediate Review**: Conduct a thorough review of PowerShell logs across all servers.
- **Restrict PowerShell Usage**: Implement restrictive policies to limit PowerShell script execution to trusted users only.