An endpoint launches a command interpreter from a document reader and immediately contacts an uncommon external domain. What should an analyst prioritize?

1. Analyze only the domain's spelling and ignore host activity
2. Treat every command interpreter process as automatically malicious
3. Close the alert because the document reader is signed
4. Investigate the process tree, command line, and related network activity