Mission briefing

Incident date2023-11-14

SiteCipherTech HQ

Your roleLead DFIR analyst

StatusUnsolved

The incident

At 15:13:52 UTC the network IDS raised a high-severity alert: a single internal host had pushed more than two gigabytes through the corporate egress proxy in under ten minutes. By the time IT Operations picked up the page, the transfer had finished.

What left was the tape-out mask set for Project Chimera, CipherTech's prototype quantum processor. The obvious suspect is the engineer whose account ran the upload. The CISO doesn't think it's that simple.

Working theory from Security: an insider was physically inside the building, sat down at somebody else's machine and used it to get the data out. Prove it or disprove it. Then name them.

What you have

A forensic snapshot of every log source we could collect, merged into one SQLite database (ciphertech.db). Open it in the evidence console or in your own tools. The facility blueprint shows where every badge reader is.

log_sources — what produced each table

employees — HR directory

access_profiles — which doors each profile opens

access_cards — permanent badges

temp_badges — reception-issued temporary cards

door_logs — every badge swipe

workstations — asset inventory

dhcp_leases — IP ↔ MAC over time

endpoint_events — EDR: logons, USB, processes

ids_alerts — Suricata alerts

network_flows — internal NetFlow

proxy_logs — egress proxy

dns_logs — internal resolver

file_system — EDR file telemetry

it_assets — hardware register

helpdesk_tickets — ServiceDesk

chat_logs — CipherChat messages

email_metadata — message trace

witness_statements — HR interviews

Your objectives

The machine. The hostname of the workstation the data was uploaded from.
The owner. The username of the employee that workstation is assigned to.
The ghost. The username of the person who was actually at the keyboard.
The exit. The door_logs.id of the swipe where the ghost left the building after the theft.
The drop. The public IPv4 address of the server that received the data.
The payload. The decoded file name of the archive that was stolen, including its extension.

Flag format

Join the six answers with underscores, in order, inside OPSEC{ }:

OPSEC{hostname_owner_ghost_exitid_dropip_filename}

Made-up example: OPSEC{FIN-WS09_jdoe_asmith_123_192.0.2.10_q3-report.zip}. The checker ignores upper/lower case, but every character counts. Submit on the flag page.

Field notes

Every answer is in the database, and every one has at least one plausible wrong answer next to it. If a single query gives you an answer, try to disprove it with a second log source before you trust it.

Hint 1 · Where to start

Start from the alert, not from the people. Read log_sources in full before you join any two tables.

Hint 2 · Machines

An IP address identifies a machine only at a particular moment. Inventory snapshots age.

Hint 3 · People

An account is not a person, and a badge is not a person either. When two log sources disagree about time, check whether they even use the same clock.

Hint 4 · Destinations

A proxy only records the name the client asked for. A name can point at many addresses over one afternoon.

Hint 5 · Files

The telemetry pipeline encodes file names, and not always the same way. The command that did the copying tells you which files it would have picked up.

Trust no one. Verify everything.