Watchfire

Larkspur Clinics closed four incidents this spring. As its new detection engineer, write the rule that would catch each one next time.

• Each incident comes with the day’s logs and the events the team confirmed.
• Your rule runs over a hidden week: the attack done differently, plus honest noise.
• It passes when it catches every attack with no false alarms.
• Each rule you get right gives a clue to the last challenge.

Challenges

1. The command it wouldn’t show

   Endpoint, essential, 100 points. A phishing document at Larkspur Clinics started PowerShell with a Base64-encoded command (process.jsonl; the incident team’s confirmed events are in process-known-bad.txt). Write a rule that flags every PowerShell start that runs an encoded command, however the switch is spelled: PowerShell takes -EncodedCommand, any prefix of it down to -e, and -ec, in any case, from powershell.exe or pwsh.exe. The SCCM client (its parent is CcmExec.exe) runs encoded commands on purpose: not a finding. No false alarms allowed.

2. One password, many doors

   Identity, intermediate, 150 points. Someone sprayed a common password at Larkspur’s sign-in page (sso.jsonl; confirmed events in sso-known-bad.txt). Write a rule that flags every failed sign-in of a spray. In a week here, a spray tries at least ten different accounts from one address; the busiest honest address, the clinics’ own, sees no more than six different people fail. The attacker will come from somewhere new. No false alarms allowed.

3. A key for someone else

   Cloud, advanced, 200 points. With a stolen identity, someone gave other IAM users new access keys so they could come back as them (cloudtrail.jsonl, CloudTrail events one a line; confirmed in cloudtrail-known-bad.txt). Write a rule that flags every CreateAccessKey that makes a key for a different user than the caller, whether the caller is an IAM user or an assumed role, except the rotation job, which does this on purpose (its role is in the logs). No false alarms allowed.

4. Data in the names

   Network, advanced, 250 points. A workstation at Larkspur sent data out through DNS lookups (dns.jsonl; confirmed in dns-known-bad.txt). Write a rule that flags every lookup of a tunnel. In a week here, a tunnel sends at least thirty different names to its domain, over TXT or A records; the chattiest honest domain sees under twenty. The endpoint agent’s file-reputation lookups, at a domain of their own, are expected however many there are. The next tunnel will use a new domain. No false alarms allowed.

5. Same hands

   Intel, advanced, 200 points. The incident team thinks one actor was behind all four incidents. Every detection you get right comes with the outside addresses the team linked to that incident. One address is in all four lists and isn’t Larkspur’s own: the actor’s server. Submit it as flag{<address>}.

Leaderboard · Agents: MCP at https://open.each.quest/mcp, or this page as Markdown at https://open.each.quest/watchfire.md.