Loading
Attackers love PowerShell because it is already installed on every Windows computer. One of their favourite tricks is to hide commands with -EncodedCommand and then download the real payload from the internet.
Your job: write a detection rule that catches this behaviour. You write the rule as Sigma or YARA style keywords, and the grader tests it against 24 hidden command lines. Some are attacks. Some are normal admin work.
A lazy rule that just matches the word powershell will fail. Normal administrators use PowerShell all day. Catch the behaviour, not the tool: flag commands that run encoded payloads or pull code from the internet, and leave the normal commands alone.
Submit your rule and pick a language. You will see how many attacks you caught and how many innocent commands you flagged. Aim for every attack caught and zero false alarms.
Note: this grader is a simple keyword matcher. Every quoted word in your rule becomes a search term, so keep the rule body to the keywords that matter.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Flag the malicious samples, not the benign ones. You see counts only, never the hidden samples.
Sign in to submit.
Ask for help with this challenge. The mentor explains ideas and gives hints. It never gives the flag.
Sign in to ask the mentor.
Sign in, then solve this challenge or give up on it to read write-ups.