Initial containment for suspected data exfiltration by a specific user account should prioritize immediately restricting that account's ability to access and transfer data. "Access control" is the broad containment category that includes disabling the account, suspending sessions, revoking tokens, removing access to sensitive shares, and applying conditional access blocks. This is the fastest way to stop ongoing data loss while preserving evidence for investigation. "Change passwords regularly" is a general security hygiene practice, not an initial incident containment action, and it may not stop exfiltration quickly if active sessions or tokens remain valid. "Isolate the storage" can be appropriate if a particular repository is being actively exfiltrated, but it can be disruptive to business operations and may not address the actor's continued access paths across other systems. DCAP is a programmatic capability for monitoring and controlling data access over time; it is valuable, but it is not the immediate first step when the SOC must rapidly stop suspected exfiltration. From a SOC playbook view, the initial action is to reduce attacker/insider access immediately (account restriction), then scope what data was accessed, preserve logs, and coordinate with HR/legal for insider procedures.

Security logs are the primary source for auditing access and changes to protected objects, including files and folders, when file auditing is enabled. In Windows environments, this typically maps to "Object Access" auditing, which can record who accessed a file, what type of access was attempted (read, write, delete), and when it occurred. For a SOC analyst investigating unauthorized modifications, the goal is attribution (which user/account), timing (outside business hours), and action (write/modify/delete). Authentication logs show who logged in and from where, but they don't reliably indicate which file was modified unless correlated with object access events. Firewall and general network logs can help confirm remote access paths or suspicious connections, but they won't provide authoritative "who modified which file" evidence. In practice, the SOC would validate that file/folder auditing is enabled on the file server and that relevant events are being collected centrally. Then they correlate file access/modify events with sign-in activity, source device, and any privilege escalation indicators. Because the question specifically asks for determining "who accessed the files and when modifications occurred," Security logs are the most direct and forensically valuable option.

The highest-signal next step is to scope and confirm the suspicious execution pattern by identifying related process creation events. Event ID 4688 records process creation in Windows Security logs when auditing is enabled, and it can capture command-line details that confirm the use of -ExecutionPolicy Bypass and - NoProfile, as well as parent/child relationships. Since the activity is on a domain controller and the parent is winrm.exe (remote management), the SOC must quickly determine whether this is isolated or part of a broader remote execution campaign. Searching for similar 4688 events over a relevant window (such as the last 24 hours) helps identify frequency, affected accounts, and whether the same command line or script path appears across hosts. Event ID 4625 (failed logon) can provide context for brute force attempts, but it does not directly validate or scope the suspicious PowerShell executions already observed. Event ID 7045 (new service installation) is important if there are signs of service-based persistence, but it is a different hypothesis. Event ID 5145 is about network share access and can be useful for lateral movement, but the immediate priority is to scope execution behavior. Therefore, focusing on 4688 process creation for similar PowerShell executions is the best primary step.