Needle In a Slice Cyber Challenge | Emerging Threat Research Kampung

The Scenario

Every second, a modern network generates enormous amounts of data: signalling exchanges, authentication and registration events, session setup and teardown, name resolution, application traffic, and countless other packets crossing the wire.

The challenge is not a lack of data. The challenge is knowing what the data means. In a real-world environment, security teams face mountains of seemingly unrelated events. Most are legitimate. Some are unusual. A small number may represent the early signs of a cyberattack. The difficulty lies in connecting these individual events and understanding the context behind them.

A 5G network makes this harder still. Traffic is split across the control and user planes, spread over multiple interfaces and network functions, and carried by protocols that most analysts encounter far less often than HTTP or SMB. Evidence of an intrusion is rarely found in one place.

Your Mission

You will be given a capture from a simulated 5G environment carrying a large, diverse volume of traffic. Somewhere within it are indicators of potentially malicious activity.

Your task: Discover → Correlate → Contextualise → Identify

You will need to determine how seemingly independent events connect to reveal a larger security story. E.g., an unusual login may appear harmless. A brief connection to an external host may seem insignificant. A configuration change may look like routine administration. But when these events are viewed together, across systems, users, time and network activity, they may reveal a completely different picture.

What you are given

Approximately 500GB of packet capture from a 5G network, provided as one PCAP file.

What to submit

One PDF report, named TeamName_Div0Challenge.pdf, submitted via email before the deadline. The report must contain the following sections.

1. Methodology: How you approached the capture: your triage strategy for narrowing down 500 GB of traffic, the tools and techniques you used, and why you chose them.

2. Findings: The attack you identified, supported by evidence: timestamps, flows, protocol anomalies and relevant packet excerpts.

3. Attack Narrative: A reconstructed timeline of the attacker’s activity, from the earliest indicator through to the impact on the network.

   
   

How You Will Be Judged

This challenge has no flag, no scoreboard and no automated validation. Your report is the entire submission, and your process matters as much as your conclusion. A well-evidenced investigation that reaches a partially correct answer will score above a correct answer with no reasoning behind it.

Submissions are assessed on:

• Investigative Rigour: Is your triage approach sound and appropriate to the scale of the data?

• Quality of Evidence: Can a judge follow the chain of reasoning from raw traffic to your conclusion?

• Accuracy: Is the identified attack correct, or at minimum well-supported and plausible?

• Clarity: Is the report well-structured and clearly written?

• Ingenuity: Is your approach to handling data at this scale original or notably efficient?

  
  

Rules

Eligibility and teams

• You may enter as an individual or as a team

• One submission per individual or team

• Do not share findings, extracted artefacts or partial analysis with other entrants until submissions have closed

Tooling

You may use any analytical method: manual inspection, scripting, statistical and traffic analysis, custom tooling, and open-source or commercial tools.

AI assistance is permitted.

⚠️ Advisory: This challenge is not a contest to determine which LLM performs best or how effectively participants can divide logs into chunks for an LLM to analyse. The aim is to explore how AI can be used intelligently as a tool to support threat hunting, rather than replace the investigation.

Timeline

Challenge Launched

• The challenge will officially launch on 15 October 2026 and will be open for registration for one month, until 15 November 2026

• Participants can register their interest through Div0

• Upon registration, participants will be able to download the challenge artefacts

Challenge Closed

• The artefact download link will close on 15 November 2026. After this date, we will not accept new registrations or downloads

• Participants who have downloaded the artefacts will have one additional month to complete the challenge

• The challenge will officially close on 15 December 2026

  
  

Assessments

• All submissions will be assessed, and the assessment process will be completed by 15 January 2027

• We will notify the winner after the assessment is complete

• Teams will be shortlisted at the end of the challenge and invited to present their findings online as part of the evaluation process

Winner

Your submission will be assessed alongside other participants' submissions. We will select one winner and notify them via email.

Awards

• The winner will be featured on the CyberXCenter and DIv0 website, including an article highlighting and documenting the winning methodology

• Prize Money: $1,000 SGD