A command written so you would not read it Start this lab

Why this matters

Obfuscation is a reading problem before it is a detection problem: nothing can be judged until the command is in plain text.

Concepts

Objectives graded

• Read the command in plain text and file what it actually does
• Separate encoded-but-legitimate deployment from the attack
• Enable the logging that records commands in plain text

MITRE ATT&CK coverage

An encoded command line that only becomes an incident once you decode what it actually fetches.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner decoded the command instead of filing the encoded blob.

  investigation · weight 20 · T1027.010 Obfuscated Files or Information: Command Obfuscation (Defense Evasion)

• Encoding alone was not treated as guilt: the decoded intent decided the verdict.

  investigation · weight 15 · T1105 Ingress Tool Transfer (Command and Control)

• Script block logging was enabled so the next one is readable without decoding.

  behavior · weight 20 · T1562.002 Impair Defenses: Disable Windows Event Logging (Defense Evasion)

Common mistakes

• Filing the base64 string as the indicator of compromise.
• Alerting on every encoded command and drowning in deployment noise.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.