Azure Security Monitoring · David Spurlock

# Local synthetic fixture · illustrative script replay analyst@local:~/security-lab$ pwd /home/analyst/security-lab analyst@local:~/security-lab$ find fixtures scripts -maxdepth 1 -type f -print fixtures/auth-events.jsonl fixtures/README.md scripts/auth-triage.sh analyst@local:~/security-lab$ sed -n '1,20p' scripts/auth-triage.sh #!/usr/bin/env bash set -euo pipefail events="${1:-fixtures/auth-events.jsonl}" test -r "$events" || { printf 'fixture unavailable\n' >&2; exit 1; } jq -r 'select(.event == "login_failed") | .src_ip' "$events" \ | sort | uniq -c | sort -nr analyst@local:~/security-lab$ ./scripts/auth-triage.sh fixtures/auth-events.jsonl 14 192.0.2.18 3 198.51.100.7 analyst@local:~/security-lab$ jq -r '.event' fixtures/auth-events.jsonl | sort | uniq -c 17 login_failed 6 login_success analyst@local:~/security-lab$ python3 - <<'PY' import json from collections import Counter from pathlib import Path rows = map(json.loads, Path("fixtures/auth-events.jsonl").read_text().splitlines()) counts = Counter(row["src_ip"] for row in rows if row.get("event") == "login_failed") print({ip: n for ip, n in counts.items() if n >= 5}) PY {'192.0.2.18': 14} analyst@local:~/security-lab$ printf '%s\n' 'Review source events before escalating.' Review source events before escalating. analyst@local:~/security-lab$ cat fixtures/README.md Synthetic authentication events for a local training exercise. Documentation addresses only: 192.0.2.0/24 and 198.51.100.0/24. No production identities or systems are represented. analyst@local:~/security-lab$ printf '%s\n' 'Threshold reached; verify context and scope.' Threshold reached; verify context and scope.

From ciphertext
to context.

Paste the recovered key. The scrambled lettering across this site will resolve into the full portfolio.

Need a clue? +

Open target.hash, then use “Prepare command” to put that hash into the shell. Press Enter. The word it recovers is your key.

Another clue +

The word is one of the values in clues.txt.

Reveal the key +

The key is integrity.

7░Δ0Ω 3Ж6Ш9▓Λ2 Σ5Ц8▒Ξ1Ψ4Ф

4 Ф7░Δ0Ω3 Ж6Ш9 ▓Λ2 Σ5 Ц8▒ Ξ1Ψ 4Ф7 ░Δ0Ω3 Ж6Ш 9▓Λ2Σ5Ц8, ▒ Ξ1Ψ4 Ф7░Δ0Ω3Ж, 6Ш9▓, Λ2Σ 5Ц8▒Ξ1Ψ4Ф7 ░Δ0 Ω3Ж6Ш9▓Λ 2Σ5Ц8▒Ξ. 1Ψ4 Ф7░Δ0 Ω3Ж6Ш9 ▓Λ 2 Σ5Ц8▒Ξ1Ψ 4Ф7░Δ0Ω3Ж; 6 Ш9▓Λ2’Σ 5Ц8▒Ξ1Ψ4 Ф7.

1Ψ4Ф 7░Δ0 Ω3Ж6Ш9▓Λ2 Σ 5Ц8▒Ξ 1Ψ4Ф7░Δ0Ω 3Ж6Ш9▓Λ2Σ5Ц8▒Ξ 1Ψ 4 Ф7░Δ0Ω3 Ж6Ш9▓Λ2Σ5Ц 8▒Ξ1Ψ4Ф7░ Δ0Ω3Ж6 Ш9▓ Λ2Σ 5Ц8▒Ξ1Ψ4Ф7░Δ0 Ω3Ж6 Ш9▓Λ 2Σ 5Ц8▒. Ξ1Ψ 4Ф7░Δ0Ω 3Ж6Ш, 9▓Λ2, Σ5Ц8▒Ξ1Ψ4Ф7, ░Δ0 Ω3Ж6Ш9▓ Λ2Σ 5Ц8 ▒Ξ1 Ψ4Ф7░Δ0Ω3 Ж6Ш9▓Λ2Σ 5Ц8▒Ξ1Ψ4Ф7.

▒Ξ1Ψ4Ф7░Δ0Ω3Ж 6Ш9Ц8▒ Ξ1Ψ4Ф7░Δ0Ω3Ж6 Ш9▓Λ 2Σ5Ц · 8▒Ξ1Σ5Ц8▒Ξ1Ψ 4Ф7░ Δ0Ω3

← Λ2Σ5 Ц8 ▒Ξ1 Ψ4Ф7░Δ0Ω

8▒Ξ 1 Ψ4Ф7 ░Δ

5Ц8▒Ξ 1Ψ4Ф7░Δ0Ω3Ж6 Ш9▓Λ2Σ5Ц 8▒Ξ1Ψ 4Ф7░Δ0Ω 3 Ж6Ш9 ▓Λ2Σ5Ц8▒Ξ1 Ψ4Ф7░Δ 0Ω3Ж6 Ш9▓Λ2Σ5Ц8 ▒Ξ1 Ψ4 Ф7░Δ0Ω3Ж6. Ш9▓Λ 2Σ5 Ц8▒Ξ1 Ψ4Ф 7░Δ0Ω3Ж 6Ш9▓Λ2Σ5Ц8▒Ξ1 Ψ4Ф7░ Δ0Ω3Ж 6Ш9▓Λ2 Σ5Ц 8▒Ξ1Ψ 4Ф7░Δ 0Ω3Ж6Ш9▓ Λ2Σ 5Ц8▒Ξ1Ψ4.

2Σ5 Ц8▒Ξ1Ψ 4 Ф7░Δ0Ω3 Ж6

▓Λ2Σ5Ц 8▒Ξ 1Ψ4Ф7░Δ0 Ω3Ж6 Ш9▓Λ2Σ5 Ц8▒ Ξ1Ψ4 Ф7░Δ0 Ω3Ж6Ш9▓Λ2Σ5Ц8▒ Ξ1Ψ4Ф7░Δ 0Ω3 Ж6Ш9▓Λ2Σ5, Ц8▒Ξ1Ψ4 Ф7░Δ0Ω3Ж6Ш 9▓Λ2Σ5Ц8 ▒Ξ1Ψ4Ф7░ Δ0Ω3 Ж6Ш9▓Λ2Σ5 Ц8▒Ξ1Ψ4Ф7░Δ0.

Ш9▓Λ2Σ5 Ц8▒Ξ1: Ж6Ш · 9▓Λ2Σ5Ц8▒Ξ1Ψ4 Ф7░Δ 0Ω3Ж. Ж6Ш9▓Λ2Σ5 Ц8▒Ξ1 Ψ4Ф 7░Δ0Ω3Ж6Ш9 ▓Λ2Σ5 Ц8 ▒Ξ1Ψ4Ф7░Δ0 Ω3Ж6Ш9▓Λ2Σ5Ц8▒, Ξ1Ψ4Ф7░Δ 0Ω3Ж6Ш9▓, Λ2Σ 5Ц8▒Ξ1Ψ4Ф7.

░Δ0 Ω 3Ж6Ш9▓Λ2Σ5 Ц8

Ф7░Δ0Ω3Ж 6Ш9 ▓Λ2Σ5Ц8▒Ξ1Ψ 4Ф7 ░Δ0Ω3Ж6Ш9▓ Λ2Σ5Ц8▒Ξ1Ψ4Ф7░Δ0 Ω3Ж6Ш9 ▓ Λ2Σ5Ц 8▒Ξ1Ψ4Ф 7░Δ0Ω 3Ж6 Ш9▓Λ2Σ5Ц 8▒Ξ1Ψ 4Ф7░Δ0Ω3Ж.
Ψ4Ф7 ░Δ0Ω3Ж6Ш9▓ Λ2Σ-5Ц 8▒Ξ 1Ψ4Ф7░Δ0 Ω 3Ж6Ш9▓Λ2 Σ5Ц8▒Ξ1Ψ4 Ф7░Δ 0Ω3Ж6Ш 9▓Λ 2Σ5Ц8▒Ξ1 Ψ4Ф7░.
Ξ1Ψ4Ф 7░Δ0Ω3 Ж6Ш 9▓Λ2-Σ5Ц8▒Ξ1Ψ4Ф7░ Δ0Ω3Ж6, Ш9▓Λ2Σ5Ц8▒ Ξ1Ψ4, Ф7░Δ0, Ω3Ж6Ш9▓, Λ2Σ 5Ц 8▒Ξ1Ψ.

8 ▒Ξ1 Ψ4Ф7░Δ0Ω3

5Ц8 ▒Ξ1Ψ4 Ф7░Δ 0Ω3Ж6Ш9▓Λ2Σ5 Ц8▒Ξ1Ψ4Ф7░Δ0 Ω3Ж 6Ш9▓Λ2Σ5Ц8▒Ξ1 Ψ4Ф7░Δ0 Ω3Ж6Ш9▓ Λ2Σ5Ц8▒Ξ1Ψ 4Ф7░Δ 0Ω 3Ж6Ш9 ▓Λ2Σ5Ц8▒Ξ 1Ψ4Ф7░Δ0Ω3.
2Σ5Ц8▒Ξ1Ψ4 Ф7░ Δ0Ω3Ж6Ш 9▓Λ 2Σ5Ц8▒Ξ1 Ψ4 Ф7░Δ 0Ω3 Ж6Ш9▓Λ2Σ 5Ц8▒Ξ1Ψ4 Ф7 ░Δ0Ω3Ж6 Ш9▓Λ2Σ5Ц.

▓Λ2Σ5 Ц8▒Ξ 1Ψ4Ф7

Ш9▓ Λ2Σ5Ц 8▒Ξ1Ψ4 Ф7 ░Δ0Ω3Ж6Ш 9▓Λ 2Σ5 Ц8▒ Ξ1Ψ4Ф7░Δ 0Ω 3Ж6Ш 9▓ Λ2Σ5 Ц8▒Ξ1Ψ4Ф7 ░Δ0Ω3Ж6Ш9▓Λ2Σ5.

Ж6Ш9 ▓ Λ2Σ5Ц8▒

Ω3Ж 6Ш9▓Λ 2Σ5Ц8▒Ξ 1Ψ4Ф7░Δ0 Ω3Ж6Ш9▓ Λ2Σ5Ц8▒Ξ1Ψ4Ф 7░Δ0Ω3 Ж6Ш 9▓Λ2Σ5 Ц8▒Ξ1Ψ4Ф7░.
Δ0Ω3Ж6Ш9▓ Λ2Σ5Ц8▒Ξ1Ψ 4Ф7░ Δ0Ω 3Ж6Ш9▓Λ 2Σ 5Ц8▒Ξ 1Ψ4Ф7 ░Δ0 Ω3 Ж6Ш9▓Λ2Σ5Ц8▒Ξ1 Ψ4 Ф7░Δ0Ω3 Ж6Ш9 ▓Λ2Σ5 Ц8 ▒Ξ.

7░Δ0 Ω 3Ж6Ш 9▓Λ2 Σ5

4Ф7░Δ 0Ω3Ж6Ш9▓Λ2Σ5 Ц8▒ Ξ1Ψ4Ф 7░Δ0Ω3 Ж6Ш9▓Λ 2Σ 5Ц8▒Ξ1Ψ4Ф 7░ Δ0Ω3Ж6Ш9▓ Λ2Σ5Ц8▒Ξ 1Ψ4Ф7░ Δ0Ω3Ж6 Ш9▓Λ 2Σ5Ц8▒Ξ 1Ψ4Ф 7░Δ 0Ω3Ж6Ш9▓Λ2 Σ5Ц8▒.

Decrypt the site.

From ciphertext
to context.

7░Δ0Ω 3Ж6Ш9▓Λ2 Σ5Ц8▒Ξ1Ψ4Ф

8▒Ξ 1 Ψ4Ф7 ░Δ

░Δ0 Ω 3Ж6Ш9▓Λ2Σ5 Ц8

8 ▒Ξ1 Ψ4Ф7░Δ0Ω3

▓Λ2Σ5 Ц8▒Ξ 1Ψ4Ф7

Ж6Ш9 ▓ Λ2Σ5Ц8▒

7░Δ0 Ω 3Ж6Ш 9▓Λ2 Σ5

▒ Ξ1Ψ4Ф7 ░Δ0Ω

7░Δ0 Ω3Ж6Ш9▓ Λ2Σ5 Ц8▒Ξ?

From ciphertextto context.

From ciphertext
to context.