Incident responsemedium250 pts0 solves

Triage the Alert

EDR flagged WS-117. You received the process list, a netstat snapshot and exported process-creation events. Find the malicious chain and the hidden command.

Learning objectives

Triage an alert: analyse process trees, spot suspicious parent/child relationships and decode PowerShell -enc commands.

Instructions

Use processes.csv, netstat.txt and events.json (synthetic). The flag is inside the decoded PowerShell command.

Prerequisites: Base64 decoding (note PowerShell uses UTF-16LE).

Flag format: cspk{...}

Files: events.json (4.6 KB), processes.csv (0.2 KB), netstat.txt (0.2 KB) (download after registering)

Useful tools: Sysmon (Sysinternals) Chainsaw

References

MITRE ATT&CK T1059.001 — PowerShell
Microsoft Learn — powershell.exe -EncodedCommand

Write-up

The full write-up and learning takeaways unlock after you solve this challenge — spoilers stay hidden until then.