---
title: "Analyst capstone"
description: "Decode a synthetic alert, extract its indicators, and document a reproducible local workflow."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.serialize.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Analyst capstone

This capstone combines the reasoning patterns used in public security courses while keeping the data synthetic and the work entirely local.

## Scenario

An alert contains a PowerShell `-EncodedCommand` value. Your task is to recover the command, identify any URLs or IP addresses, prepare report-safe indicators, and document the exact transformation sequence.

Use this sample:

```text
VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEgAZQBsAGwAbwAgAGYAcgBvAG0AIABTAGUAcgBpAGEAbABpAHoAZQAiAA==
```

## Requirements

1. Decode the Base64 wrapper.
2. Determine the correct character encoding from the byte pattern.
3. Recover readable PowerShell text without executing it.
4. Explain why Base64 alone produced alternating null bytes.
5. Add an indicator extractor only if the recovered sample contains indicators.
6. Save the minimal explicit recipe.
7. Record a safety statement and the source of every assumption.

## Reference solution

Install [Decode a PowerShell EncodedCommand](/recipes/security-analysis/decode-powershell-command/). Step through each operation and compare its intermediate output with your investigation notes.

For a richer self-created sample, use documentation-only domains ending in `.test` and addresses from RFC documentation ranges. Then append [Extract and defang URLs](/recipes/security-analysis/extract-defang-urls/) or [Extract and defang IP addresses](/recipes/security-analysis/extract-defang-ips/).

## Reflection questions

- Which evidence justified UTF-16LE rather than UTF-8?
- Which operations changed representation, and which changed meaning?
- What would be unsafe to do with a real recovered script?
- Could another analyst reproduce the result from your saved recipe and sample?
- Which claims still require external validation outside Serialize?

Source: https://help.serialize.dev/courses/analyst-capstone/index.mdx