Having attended the series, to become a Sophos EDR Certified Admin, you now just need to take a short test to validate your knowledge. Completion of this (the pass mark is 80%) will automatically send over your certificate, which you can print out and proudly display for everyone to see! Head to the link below to Enrol into the course and access the test via the Take Exam button. You’ll need a SophosID to sign in – you can create a free one if you don’t have one already.
Take a look at https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ - it might give some more background
What am I missing with question that indicates encoded PowerShell command? https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_pwsh?view=powershell-7.1#-encodedcommand---e---ec shows it, but I get wrong result.
Is there any handbook?
Thanks for sharing