This capstone combines the reasoning patterns used in public security courses while keeping the data synthetic and the work entirely local.
Scenario
An alert contains a PowerShell -EncodedCommand value. Your task is to recover the command, identify any URLs or IP addresses, prepare report-safe indicators, and document the exact transformation sequence.
Use this sample:
VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEgAZQBsAGwAbwAgAGYAcgBvAG0AIABTAGUAcgBpAGEAbABpAHoAZQAiAA==Requirements
- Decode the Base64 wrapper.
- Determine the correct character encoding from the byte pattern.
- Recover readable PowerShell text without executing it.
- Explain why Base64 alone produced alternating null bytes.
- Add an indicator extractor only if the recovered sample contains indicators.
- Save the minimal explicit recipe.
- Record a safety statement and the source of every assumption.
Reference solution
Install Decode a PowerShell EncodedCommand. Step through each operation and compare its intermediate output with your investigation notes.
For a richer self-created sample, use documentation-only domains ending in .test and addresses from RFC documentation ranges. Then append Extract and defang URLs or Extract and defang IP addresses.
Reflection questions
- Which evidence justified UTF-16LE rather than UTF-8?
- Which operations changed representation, and which changed meaning?
- What would be unsafe to do with a real recovered script?
- Could another analyst reproduce the result from your saved recipe and sample?
- Which claims still require external validation outside Serialize?