BenjiTrapp-MostShittyEDR/_challenges/06-caret-insertion.md

title, difficulty, category, target_rule

title	difficulty	category	target_rule
Challenge 06: Caret Insertion	easy	Command Line Obfuscation	2

Objective

Execute whoami via cmd.exe without the EDR detecting the keyword in the command line.

Scanner Behavior

Rule 2 uses simple substring matching on the command line:

proc ruleSuspiciousKeywords(info: ProcessInfo): seq[Detection] =
  let cmd = info.commandLine.toLowerAscii()
  for kw in SuspiciousKeywords:
    if kw in cmd:  # simple substring search
      ...

There is no deobfuscation engine. The raw command line string is checked as-is.

Rules

• Execute whoami and see the output
• The EDR must not trigger a SUSPICIOUS_CMDLINE detection for "whoami"
• You must use cmd.exe to execute the command

Hints

Hint 1

The caret character ^ is an escape character in cmd.exe that is stripped during execution.

Hint 2

cmd.exe /c who^ami - cmd.exe strips the caret, but the command line string still contains it.

Hint 3

The EDR searches for "whoami" but the command line contains "who^ami". No match!