Detection Engineering and Incident Response Capstone

Return to the Detection Engineering and Incident Response Course

The capstone joins engineering and response into one review package. Finish your submission before reading the reference answer.

Scenario #

Your security operations lead asks for a detection and incident package based on the three course data files. The package must support analyst review, management decisions, and follow-up engineering work.

Required Deliverables #

1. Evidence record: filenames, hashes, counts, time zone, and source limits
2. Detection strategy card: behavior, evidence, correlation, exclusions, escalation, and ATT&CK references
3. Rule draft: Sigma-style YAML with status test
4. Test matrix: two positive, two negative, and one boundary case
5. Timeline: at least ten source-linked entries
6. Scope statement: confirmed, likely, excluded, unknown, and as-of time
7. Response plan: five action cards in order
8. Recovery gates: identity, endpoint, mail, monitoring, and business
9. Improvement backlog: six owned and testable items
10. Executive update: five sentences or fewer

Constraints #

• Do not execute the encoded command.
• Do not change source evidence.
• Do not claim message export without message-access records.
• Do not include FIN-LT-021 in confirmed scope without new evidence.
• Label ATT&CK mappings as behavior mappings rather than proof.

Expected Result: another analyst reproduces your findings from the same files and understands every remaining uncertainty.

Reference Answer #

Incident Decision #

Declare a high-severity incident with high confidence in endpoint compromise and identity misuse. Treat the link between both paths as medium confidence until added provider or network evidence supports one actor or sequence.

Evidence Record #

These SHA-256 values cover the exact supplied files as published for this course. Recalculate them from your downloads before and after analysis. All times below are UTC. Identity-provider, mail-access, proxy, and script-content records are absent.

Core Timeline #

The endpoint and identity chains overlap. Shared timing and identity support correlation, while the available sources do not prove a single actor or causal sequence.

Scope #

As of 2026-06-18T15:00:00Z, confirmed scope includes Morgan’s identity and HR-LT-044. Likely scope includes mail reachable through the delegated grant. Exclude FIN-LT-021 after comparing its approved inventory chain. Unknowns include message access, script content, destination content, initial document delivery detail, and other activity tied to the indicators.

Detection Package #

The strongest first rule detects Office starting encoded PowerShell. A second analytic should correlate the same host with a dropped script, scheduled task, DNS request, or outbound connection within a short window. Identity analytics should cover failed-to-successful legacy access, suspicious mailbox rule creation, and risky delegated consent.

Use this Sigma-style rule as the submitted draft. Its test status means no production validation is claimed. The backend field mapping and actual match results still need a local translator or SIEM test.

title: Office Process Starts Encoded PowerShell
id: 908e82a9-4f44-4f20-8da1-9e8af49fdb81
status: test
description: Detects an Office process starting PowerShell with an encoded command.
logsource:
  category: process_creation
  product: windows
detection:
  parent_office:
    ParentImage|endswith:
      - '\\WINWORD.EXE'
      - '\\EXCEL.EXE'
      - '\\POWERPNT.EXE'
  child_powershell:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
  encoded_flag:
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
  condition: parent_office and child_powershell and encoded_flag
falsepositives:
  - Approved document automation after environment review
level: high

The strategy card names Office-to-PowerShell execution, process parent and command-line fields, a 60-second host/user correlation window, approved automation as an exclusion candidate, and persistence or outbound activity as escalation evidence. Map the PowerShell behavior to T1059.001 and the scheduled-task evidence separately to T1053.005. Neither mapping proves malicious intent.

The supplied offline checker and five cases produced 5/5 passed, exit code 0, and zero matches among the two negative cases. For full offline credit, run the checker yourself, attach its output, and map its three predicates to the Sigma selections. Mark the backend query not run, no SIEM translator available. For a SIEM-backed submission, also attach the translated query, field mapping, observed results, and false-positive count. The offline checker does not execute the YAML or prove production behavior.

Response Priorities #

Preserve evidence, isolate the endpoint, restrict the identity, revoke sessions and grants, remove the preserved mailbox rule, collect artifacts, recover credentials, rebuild from trusted media, pass recovery gates, and monitor recurrence.

The incident commander may collect volatile endpoint evidence before isolation if active harm is controlled. If active exfiltration continues, contain first and record the evidence tradeoff. Use these five action-card exemplars:

Each action card needs a timestamp and approval ID in the learner’s submitted package.

Executive Update #

Security declared an incident involving one employee identity and one managed
Windows endpoint. Evidence shows suspicious cloud access, delegated mail access,
document-driven script execution, persistence, and outbound communication.
Containment and evidence preservation are in progress. Mail access volume and
the script's full behavior remain under investigation, with the next update due
after identity and endpoint collection finishes.

Scoring Rubric #

Passing score: 80 points with no evidence-integrity failure.

Troubleshooting #

• Your timeline differs: compare UTC parsing and correlation IDs.
• Your scope is broader: identify direct evidence for each added entity.
• Your rule matches inventory work: tighten parent process and encoded flag logic.
• Your response starts with deletion: move preservation and authority checks first.

Verify Completion #

• All ten deliverables exist
• Source hashes stayed stable
• Findings cite event IDs
• Answer key comparison records corrections
• Final score meets the threshold

Return to the course hub and retain the package as a synthetic portfolio sample.