OpenCyber AcademyLesson map
Lesson 09. Map, example, EX055.
flowchart TD
S["23:47 is a lab token"] --> D["Subtract from 23:51"]
R["23:51 is prose"] --> D
D --> F["Four minutes"]
F --> Q{"Is 23:51 a lab column?"}
Q -->|No| K["The rule stays outside the script"]
The gap is arithmetic beside the file. The file does not store the rule.
Logical drawing
lab sees
Fri 23:47 BR
prose sees
rule created 23:51
difference
4 minutes
script columns
user, when, country
Learning outcomes
After this chapter, you should be able to:
- Subtract the two Friday-night clocks.
- Say which clock is a tuple field.
- Refuse a rule column the script does not have.
9.1 The sign-in token is in the list. The rule clock is not.
Friday 23:47 is the third tuple's time field, and the lab prints it. The forwarding rule was created at 23:51, four minutes later. Four is 23:51 minus 23:47. The rule forwards any email containing "invoice" or "payment" to an outside address and deletes the copy. None of that text is a field in signins. The loop never reads a rule, a keyword, or an outside address. The address itself is not printed in this book, and this chapter does not invent one.
The second Brazil sign-in, Saturday 00:02, is eleven minutes after 23:51 if someone subtracts those clocks. That subtraction is not the four-minute gap, and it is not a lab column either. The script does not subtract times at all. It only parses an hour for the night test. Minutes never enter the predicate, so 23:47 and 23:51 would share hour 23 if both were tokens. Only 23:47 is a token.
MITRE ATT&CK is the name already used for email forwarding rules as a collection technique. BrightPath used that name while searching mailboxes. The search result is prose. This script does not emit a detection, a query, or a rule in the Sigma sense. NIST SP 800-92 is why Leo asked for 90 days of sign-in logs. The records this incident needed covered Thursday's fake page through Monday's call, which the earlier chapter calls a few days. Ninety days is the retention ask, not a printed span of this incident.
Lesson table; scroll horizontally to read all columns →
| Clock | Where it lives |
|---|---|
| 23:47 | Third tuple, printed |
| 23:51 | Prose about the rule |
| Four minutes | Subtraction beside the file |
| Saturday 00:02 | Sixth tuple, a different gap |
9.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered sentence | Where the fact lives | Decision |
|---|---|---|
| "23:47 is on the third line." | The tuple | Keep |
| "The rule is four minutes later." | Prose subtraction | Keep, labelled as prose |
| "The lab printed 23:51." | No such field | Refuse |
| "The script detected the rule." | It never reads rules | Refuse |
Synthetic case. The outside address stays unprinted.
Errors and limits
Do not add a rule column so that four minutes looks like program output.
Apply
- EX055 — Two clocks. What is 23:51 minus 23:47, which of those clocks is a lab field, and does the script see the forwarding rule?
Show marking criteria
Rubric: 3 = four minutes; 23:47 is the tuple; 23:51 is prose; the script has no rule column and does not print the outside address;; 2 = four minutes, and only 23:47 is in the print;; 1 = one clock;; 0 = none.