Trace the Fanar Endpoint

An EDR alert fired on powershell.exe on Fanar Hotels workstation FANAR-FD-02. You have the process tree, authentication events and the account context. Run the investigation loop: trace the lineage up to the root cause and down to the impact, establish the identity scope, and review persistence. Read lineage and command lines, not process names.