The challenge
These scripts reach for native APIs by name, but a name isn't a behavior. Map each reference to the receipt-backed action it models, and flag the call whose claimed purpose the evidence doesn't support.
811 questions in the Single Solve (1,622 in Mastery), across the families built up since Day 1: polyglot 220, Python 126, Bash 112, JScript 72, Batch 72, VBScript 72, host profiles 66, Node.js 56, plus the PowerShell scenario sets. 58 question IDs were new versus Day 10, all in existing families: Bash dynamic file descriptor and nameref dispatch samples, and TypeScript polyglots (benign utility, downloader, …). Formats include exact values and ATT&CK IDs (T#### / T####.###).
Reading the prompt: what it said we'd need
| Clue | What it pointed to | What I did about it |
|---|---|---|
| "reach for native APIs by name" | scripts that look up APIs or commands indirectly | The chain solver already maps each sample's calls to roles and techniques |
| "a name isn't a behavior … receipt-backed action" | answer from what the script does, not what it's called | Same principle as every earlier Script day; no change needed |
| "flag the call whose claimed purpose the evidence doesn't support" | one deliberately mislabelled reference | Covered by the existing per-sample fields; every answer was accepted |
Safety
Static only: scripts were parsed as text on our Kali VM, never executed.
Single Solve (the solver, 28 batches)
The solver sent the core chain solver's 683 answers first, then the add-ons' answers one field at a time (1 s apart since the Day 10 rate-limit fix): Batch control/expansion labels, VBScript control, and the rest. All 811 accepted; CORRECT at 13:08:40 UTC, flag 4be73b90…5693.
Time Trial and Mastery
Time Trial 9 s clock, ranked; vs started_at: start +166, artifact +449, solve +610,
ready +611, submit +1614 ms 811 answers CORRECT e46c68a4…8b2e
Mastery 11 s clock; vs started_at: start +228, artifact +536, solve +851, ready +853, submit +1776 ms
1622 answers CORRECT 79fc66b3…238c
Time to solve
The 9:00 ET run hit an HTTP 429, so the solver re-ran with paced submits: the Single Solve started at 13:07:56 UTC and went CORRECT at 13:08:40 after 28 batches, all accepted. The ranked Time Trial and the Mastery each went CORRECT on the first submit, for 59 s from the first start to the last CORRECT.
Takeaways
- The chain solver absorbed 58 new question IDs with no change. The families (role, attack, campaign, steps…) are stable even when the sample changes.
- The Single Solve's one-field-at-a-time add-on batches are the slow part (44 s, rate-limited by design). The timed modes send everything in one submit and took under 2 s each.