Detection Engineering Capstone Answer Key

Return to the Detection Engineering and Incident Response Capstone

Open this reference after you finish and score your capstone. Record each difference as a correction, unsupported claim, or remaining evidence gap.

Incident Decision #

Declare a high-severity incident with high confidence in endpoint compromise and identity misuse. Treat the link between both paths as medium confidence until added provider or network evidence supports one actor or sequence.

Evidence Record #

These SHA-256 values cover the exact supplied files as published for this course. Recalculate them from your downloads before and after analysis. All times below are UTC. Identity-provider, mail-access, proxy, and script-content records are absent.

Core Timeline #

The endpoint and identity chains overlap. Shared timing and identity support correlation, while the available sources do not prove a single actor or causal sequence.

Scope #

As of 2026-06-18T15:00:00Z, confirmed scope includes Morgan’s identity and HR-LT-044. Likely scope includes mail reachable through the delegated grant. Exclude FIN-LT-021 after comparing its approved inventory chain. Unknowns include message access, script content, destination content, initial document delivery detail, and other activity tied to the indicators.

Detection Package #

The strongest first rule detects Office starting encoded PowerShell. A second analytic should correlate the same host with a dropped script, scheduled task, DNS request, or outbound connection within a short window. Identity analytics should cover failed-to-successful legacy access, suspicious mailbox rule creation, and risky delegated consent.

Use this Sigma-style rule as the submitted draft. Its test status means no production validation is claimed. The backend field mapping and actual match results still need a local translator or SIEM test.

title: Office Process Starts Encoded PowerShell
id: 908e82a9-4f44-4f20-8da1-9e8af49fdb81
status: test
description: Detects an Office process starting PowerShell with an encoded command.
logsource:
  category: process_creation
  product: windows
detection:
  parent_office:
    ParentImage|endswith:
      - '\\WINWORD.EXE'
      - '\\EXCEL.EXE'
      - '\\POWERPNT.EXE'
  child_powershell:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
  encoded_flag:
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
  condition: parent_office and child_powershell and encoded_flag
falsepositives:
  - Approved document automation after environment review
level: high

The strategy card names Office-to-PowerShell execution, process parent and command-line fields, a 60-second host/user correlation window, approved automation as an exclusion candidate, and persistence or outbound activity as escalation evidence. Map the PowerShell behavior to T1059.001 and the scheduled-task evidence separately to T1053.005. Neither mapping proves malicious intent.

The encoded-flag rule has a deliberate blind spot. Alternate PowerShell syntax, transformed or concatenated commands, another script host, or encoded content without -EncodedCommand need separate analytics. Record those evasion cases and their test results before claiming broad PowerShell coverage.

The supplied offline checker and five cases produced 5/5 passed, exit code 0, and zero matches among the two negative cases. For full offline credit, run the checker yourself, attach its output, and map its three predicates to the Sigma selections. Mark the backend query not run, no SIEM translator available. For a SIEM-backed submission, also attach the translated query, field mapping, observed results, and false-positive count. The offline checker does not execute the YAML or prove production behavior.

Response Priorities #

Preserve evidence, isolate the endpoint, restrict the identity, revoke sessions and grants, remove the preserved mailbox rule, collect artifacts, recover credentials, rebuild from trusted media, pass recovery gates, and monitor recurrence.

The incident commander collects volatile endpoint evidence before isolation when active harm is controlled. If active exfiltration continues, contain first and record the evidence tradeoff. Use these five action-card exemplars:

Each action card needs a timestamp and approval ID in the learner’s submitted package.

Executive Update #

Security declared an incident involving one employee identity and one managed
Windows endpoint. Evidence shows suspicious cloud access, delegated mail access,
document-driven script execution, persistence, and outbound communication.
Containment and evidence preservation are in progress. Mail access volume and
the script's full behavior remain under investigation, with the next update due
after identity and endpoint collection finishes.

Review Gate #

Use the rubric on the capstone prompt . Pass with 80 out of 100 or higher and no evidence-integrity failure.

Verify Your Review #

• Each correction points to evidence or a stated limitation
• Unsupported attribution and impact claims are removed
• The score reaches 80 out of 100
• No evidence-integrity failure remains

Return to the Detection Engineering and Incident Response Course after you record corrections and the final score.