Introduction

In the DMZ between the two sides, Pepper Minstix and Wunorse Openslae are standing next to The Great Elf Conflict:

Pepper warns me about intelligence about oncoming attacks from Team Wombley:

Pepper Minstix

This is weird, I got some intel about an imminent attack.

Pepper Minstix here! I’ve got urgent news from neutral ground.

The North Pole is facing a serious cyber threat, and it’s putting all the factions on edge. The culprits? Some troublemakers from Team Wombley.

They’ve launched a barrage of phishing attacks, ransomware, and even some sneaky espionage, causing quite the stir.

It’s time to jump into action and get cracking on this investigation—there’s plenty of cyber-sleuthing to do.

You’ll be digging into KQL logs, tracking down phishing schemes, and tracing compromised accounts like a seasoned pro.

Malware infections have already breached Alabaster Snowball’s systems, so we need swift action.

Your top mission: neutralize these threats, with a focus on the ransomware wreaking havoc from Team Wombley.

It’s a hefty challenge, but I know you’re up to it. We need your expertise to restore order and keep the peace.

You’ve got the tools, the skills, and the know-how—let’s show Team Wombley we mean business.

Ready to dive in? Let’s defend the North Pole and bring back the holiday harmony!

Wunrose doesn’t deny it:

Wunorse Openslae

Hey, Wunorse here. We at Team Wombley pulled off some nasty stuff.

Phishing attacks, ransomware, and cyber espionage, oh yeah!

We pulled loads of all-nighters to make it all happen. Energy drinks rock!

Our teams did what Alabaster said we never could and breached Santa’s network. We’re so rad.

It would take a master defender to fix all the damage we caused. But defense is so lame! Offense is where it’s at.

You should just leave them to panic and join our side. We’re the coolest, don’t you want to be like us?

KC7 Overview

The link in the badge or the globe on the map lead to The Great Elf Conflict page on KC7. KC7 is a free-to-play gamified upskilling platform that offers all kinds of modules that allow for investigating malicious events in the web browser.

The Play Now button at the top right opens a list of 27 standard KC7 modules available to the community at the time of this writing.

I’ll create an account and login to the Holiday Hack challenge module for this year.

The setup is to have a question down the left side, and the panel to run KQL queries on the right:

Clickong on “Section 1: KQL 101” at the top, I’ll see the list of sections in this module:

There are four sections, each with between seven and eleven questions.

To get credit for each section in my snowball badge, I’ll need to give it the last answer to each section. Finishing two sections grants a silver solve, and all four gives gold.

KQL 101

Question 1

Welcome to your mission to solve the The Great Elf Conflict! To do so, you’ll need to harness the power of KQL (Kusto Query Language) to navigate through the data and uncover crucial evidence.

Your next step is to meet with Eve Snowshoes, Cyber Engineer, at the at the North Pole Cyber Defense Unit. Eve is known for unmatched expertise in KQL and has been eagerly awaiting your arrival.

Eve greets you with a nod and gestures toward the terminal. “KQL is like a key, unlocking the hidden secrets buried within the data.”

Type let’s do this to begin your KQL training.

I’ll enter “let’s do this” to solve and move on to the next question.

Answer: let’s do this

Question 2

The first command Eve Snowshoes teaches you is one of the most useful in querying data with KQL. It helps you peek inside each table, which is critical for understanding the structure and the kind of information you’re dealing with. By knowing what’s in each table, you’ll be able to create more precise queries and uncover exactly what you need.
Employees
| take 10 
Eve has shared the first table with you. Now, run a take 10 on all the other tables to see what they contain.

You can find the tables you have access to at the top of the ADX query window.

Once you’ve examined all the tables, type when in doubt take 10 to proceed.

I can start with a “take 10” on Employees to check out the data:

Click for full size image

This gives a good feel for what is in the table.

I can look at what other tables exist with .show tables:

I can spend some time looking at them, but I’ll show that as I get to each in the analysis.

Answer: when in doubt take 10

Question 3

Now, let’s gather more intelligence on the employees. To do this, we can use the count operator to quickly calculate the number of rows in a table. This is helpful for understanding the scale of the data you’re working with.
Employees
| count
How many elves did you find?

Running that command shows 90 rows in the Employees table:

Answer: 90

Question 4

You can use the where operator with the Employees table to locate a specific elf. Here’s a template you can follow:
Employees
| where <field><operator><value>
Field: The column you want to filter by (e.g., role).

Operator: The condition you’re applying (e.g., == for an exact match).

Value: The specific value you’re looking for in the field (e.g., Chief Elf Officer).

Can you find out the name of the Chief Toy Maker?

I’ll start with a look at the columns in the Employees table with a “take 10”:

Click for full size image

The “role” column seems useful here. I’ll update the query to filter on the target role:

Answer: Shinny Upatree

Question 5

Here are some additional operators the North Pole Cyber Defense Unit commonly uses.

== : Checks if two values are exactly the same. Case-sensitive.

contains : Checks if a string appears anywhere, even as part of a word. Not case-sensitive.

has : Checks if a string is a whole word. Not case-sensitive.

has_any : Checks if any of the specified words are present. Not case-sensitive.

in : Checks if a value matches any item in a list. Case-sensitive.

This challenge is just another opportunity to play. I’ll note that == and in are case-sensitive, where as contains, has, and has_any are not.

Answer: operator

Question 6

We can learn more about an elf by cross-referencing information from other tables. Let’s take a look at Angel Candysalt’s correspondence. First, retrieve her email address from the Employees table, and then use it in a query in the Email table.
Email
| where recipient == "<insert Angel Candysalt’s email address here>"
| count
How many emails did Angel Candysalt receive?

I’ll start with a “take 10” on the Email table to get a feel for it:

Click for full size image

recipient seems like the column to filter on.

I don’t know Angel’s email. There’s a few ways to find it. One would be to go back to the Employees table, and filter on name contains "angel":

Click for full size image

This gives angel_candysalt@santaworkshopgeeseislands.org. Or I could do something similar in the recipient field in the Email table directly:

Click for full size image

There’s a lot of rows, but I don’t have to look too far to find the full email.

Now I can get a more exact count filtering on the full email:

This is the correct answer, though since email addresses are not typically case-sensitive. The safer way to do this would be to wrap recipient in a tolower call:

It doesn’t change the answer here, but is worth considering.

Answer: 31

Question 7

You can use the distinct operator to filter for unique values in a specific column.

Here’s a start:
Email
| where sender has "<insert domain name here>"
| distinct <field you need>
| count
How many distinct recipients were seen in the email logs from twinkle_frostington@santaworkshopgeeseislands.org?

I”ll use the same kind of filter as the previous question, but this time add another filter to get distinct records:

The query returns a list of recipients. I’ll use count to get the number:

Answer: 32

Question 8

It’s time to put everything we’ve learned into action!
OutboundNetworkEvents
| where src_ip == "<insert IP here>"
| <operator> <field>
| <operator>
How many distinct websites did Twinkle Frostington visit?

A “take 10” look at the OutboundNetworkEvents table shows that it has a source_ip column, but nothing for user:

Click for full size image

The Employees table allows me to map user name to IP:

Click for full size image

Searching for Twinkle, I’ll find their IP as 10.10.0.36:

Click for full size image

Now I’ll search OutboundNetworkEvents for 10.10.0.36:

Click for full size image

I don’t need a distinct or count, as I can tell on a quick look there are four rows each with unique URLs.

Answer: 4

Question 9

How many distinct domains in the PassiveDns records contain the word green?
PassiveDns
| where <field> contains “<value>”
| <operator> <field>
| <operator>
You may have notice we’re using contains instead of has here. That’s because has will look for an exact match (the word on its own), while contains will look for the specified sequence of letters, regardless of what comes before or after it. You can try both on your query to see the difference!

To see what PassiveDns has, I’ll start with “take 10”:

It’s simply timestamp, ip, and domain. Given that I want records where the domain contains “green”, I’ll add that:

There’s 10 records, or I can add a count to see that more clearly:

The hint points out that contains is better than has here, as has looks for green as a word, and contains just looks for those five bytes regardless of what’s around it. has finds nothing here:

Answer: 10

Question 10

Sometimes, you’ll need to investigate multiple elves at once. Typing each one manually or searching for them one by one isn’t practical. That’s where let statements come in handy. A let statement allows you to save values into a variable, which you can then easily access in your query.

Let’s look at an example. To find the URLs they accessed, we’ll first need their IP addresses. But there are so many Twinkles! So we’ll save the IP addresses in a let statement, like this:
let twinkle_ips =
Employees
| where name has "<the name we’re looking for>"
| distinct ip_addr;
This saves the result of the query into a variable. Now, you can use that result easily in another query:
OutboundNetworkEvents  
| where src_ip in (twinkle_ips)  
| distinct <field>
How many distinct URLs did elves with the first name Twinkle visit?

Question 10 starts to show the real power of KQL. I need to first look at elves with the first name Twinkle. Given that there is no first name column, I’ll want to look for name that starts with “Twinkle “:

The space after the name is important here, as otherwise it gets “Twinkles Snowfall”, but I don’t think that should be included. I could have used has, but that would also return an elf with the last name Twinkle (none in this set, but still a flaw in the query).

I can save these IPs in a variable. If I just do that, it returns an error:

I have to have something that outputs. I’ll add the next query:

Click for full size image

This shows all the events visited by Twinkle elves. To get a count on distinct URLs, I’ll add that:

There’s 8.

Answer: 8