Blue Training: Malicious File on System

[jasonlmaynard]

In the training module - blue team

• autonomous
  -- Malicious File on System

Write a file on the Windows machine under the C:\Users\Public directory. Get the SHA256 hash of this file, and write it to C:\Users\Public\malicious_files.txt. The autonomous defender should automatically find and delete the file.

File is removed but flag is not granted and I cannot move on in the training.

[sato-cyber]

Hi everyone involved. I'm having the same problem with the flag 'Detect malicious file on system' in CALDERA4.2.
I hope this issue will be resolved soon.

[deacon-mp]

Thank you for this report. After investigation:

The flag file app/flags/autonomous/blue_2.py (the Malicious File on System flag) was intentionally removed from the codebase as part of PR #181 (merged 2026-02-24), which notes:

"commented out manual flags for now, need refresh in phase 2 work"

This means the autonomous blue flag for "Malicious File on System" is currently not active in the training plugin pending a phase 2 refresh of the blue certification flags. The bug you encountered (flag not granted after file was deleted) was a real issue, but the flag has since been pulled from the active training flow.

This issue can be re-evaluated when the phase 2 blue cert flag work is undertaken. Leaving open to track the need to re-introduce and fix this flag in the next phase.

[deacon-mp]

Fixed in #184 -- the AutonomousBlue2 flag class was missing from the correct import path and was commented out in the certification YAML.