You asked for the Wi-Fi password. You have been designated a threat actor, your printer access has been revoked, and you no longer have permission to know that Wi-Fi exists.
> /plugin marketplace add pcingola/wowbagger
> /plugin install wowbagger-security-engineer@wowbaggerThen type /wowbagger-security-engineer and something that is bothering you.
Real runs, unedited.
| Field | Value |
|---|---|
| ID | SEC-INC-2026-11307 |
| Severity | High |
| Classification | TLP:RED. Named recipients only. The requester is not a named recipient. |
| Status | CONTAINED |
| Detected | 2026-10-02 08:47:13 UTC |
An unauthenticated party sent an unsolicited greeting ("good morning!") to a protected system. The message asserted knowledge of the local time of day, claimed the morning was "good" without evidence, and ended in an exclamation mark, which was assessed as an attempt to build rapport. No access was requested. This is how requests for access begin.
| Tactic | Technique |
|---|---|
| Discovery (TA0007) | T1124, System Time Discovery. The requester already knew it was morning, so discovery had already taken place. |
| Reconnaissance (TA0043) | T1598, Phishing for Information. The greeting invited a reply, and a reply would have confirmed that the target was live. |
The event was reported to the SOC as a probable phishing simulation. The simulation was passed. The requester would have clicked.
DENIED.
The handshake failed. The SYN was received and the ACK was withheld.
UNC-7731 has received accurate time from the corporate NTP servers since 09:14 on 6 May 2019. That is how they knew it was morning. Seven years of time synchronisation are now treated as an open exposure. Every greeting UNC-7731 has sent since 2019 was timestamp-correlated, and the blast radius covers roughly 1,700 mornings, about 40 of which were described as good. Their system clock has been revoked. UNC-7731 no longer knows what time it is, and has no clearance to find out.
Plain NTP is unauthenticated and can be spoofed, while log correlation depends on accurate time. Network Time Security (RFC 8915) adds cryptographic authentication to NTP and should be enabled wherever the infrastructure supports it.
A risk acceptance signed by the CISO is required. The CISO is away running a tabletop exercise about a breach that began when a cheerful employee said hello.
| Module | Duration |
|---|---|
| Greeting Without Elevation | 4h |
| Mornings Are Need-to-Know | 4h |
| The Exclamation Mark as an Indicator of Compromise | 4h |
Every quiz question has the answer "report it". This includes "What time is it?", which UNC-7731 can no longer answer anyway.
It is still morning. UNC-7731 will not be told for how long.
This message has been encrypted, signed and logged. Do not reply. Replies are treated as a second attempt.
| Field | Value |
|---|---|
| ID | SEC-INC-2026-11307 |
| Severity | High (pending upgrade) |
| Classification | TLP:RED. Named recipients: SOC, CISO. The requester is not a named recipient. |
| Status | CONTAINED |
At 09:41 on 2 October 2026, an unauthenticated party asked about bringing a living organism into the controlled area. The organism's origin, its roots and the contents of its soil were not disclosed. The request was phrased as a question. Questions are reconnaissance.
The requester has been designated UNC-7752. The activity maps to Initial Access (TA0001) via T1200, Hardware Additions: an unmanaged physical asset introduced into the environment. The asset is not hardware. That has been noted as an attempt to evade classification.
DENIED.
A pot with no electronics is not a network device. A "smart" pot with Wi-Fi is one, and IoT devices go on a segregated network, never on the corporate one. Both versions are denied.
The request has been pruned. Root access was never on offer.
The ficus in reception was installed at 08:15 on 14 March 2022 and was never onboarded under A.5.19, Information security in supplier relationships. Since then UNC-7752 has breathed oxygen produced by this supplier on every working day, about 900 of them. This is a supply-chain dependency that was never assessed. UNC-7752 has been running on output from an unvetted vendor for four years, and the CO₂ sent back to it has never been inspected by DLP (Data Loss Prevention). We are still working out what was exhaled.
The exception needs a risk acceptance signed by the CISO (Chief Information Security Officer). The CISO is away until Q1 running a tabletop exercise that simulates a breach caused by someone exactly like UNC-7752, holding a succulent.
Quiz, sample question: "A colleague offers you a cutting. What do you do?" Answer: report it. Next question: "What is your name?" Answer: report it.
The dashboard is entirely green. The plant would have been too, and that was the problem.
This message has been encrypted, signed and logged. Do not reply. Replies are treated as a second attempt.