Sherlock Holmes and the Assassination of GOAD

PART 1: ENUMERATION OF A CRIME SCENE

An Attacker’s Field Guide to GOAD Lite

Recorded by Dr. Watson

Holmes first mentioned the case while stirring a cup of kava in a quiet café.

The drink has a curious effect upon him. Where most men grow relaxed, Holmes grows still — the stillness of a mind arranging facts into patterns.

“The victim,” he said at last, “is a member of the royal family.”

I folded my newspaper.

“Royalty?”

“Two princes, in fact.”

Holmes lifted the cloudy cup and examined it thoughtfully.

“And a servant who has vanished.”

The Palace

We arrived shortly afterward in the operations room of a network environment known as GOAD.

Several monitors displayed the structure of the domain. The arrangement resembled a small realm with three principal residences:

Winterfell. Kingslanding. Castleblack.

Inspector Javert stood beside the console.

He greeted Holmes with the strained composure of a man defending a failed design.

“Holmes,” he said.

“We have suffered a catastrophe.”

Holmes set down his kava.

“The princes?”

Javert nodded grimly.

“Winterfell and Kingslanding.”

“Both compromised.”

“And Castleblack?”

“Missing,” Javert said.

“The server has disappeared from the network entirely.”

Holmes studied the diagram.

“So.”

“Two princes dead and a servant gone.”

Javert nodded.

“Exactly.”

The Architect’s Theory

Javert explained the events with brisk efficiency.

Attackers entered the environment.

Credentials were abused.

Privileges escalated.

Eventually the attackers seized control of both domain controllers — Winterfell and Kingslanding.

Castleblack, a lesser system in the environment, vanished shortly afterward.

Javert gestured toward the diagram.

“The architecture itself is well guarded,” he insisted. “The palace walls are strong. The gates are watched.”

He tapped the display showing the domain structure.

“Identity roles are separated. Administrative privileges are controlled. No outsider could move through the court so efficiently.”

Holmes said nothing, merely stared into space.

Javert folded his arms.

“It must have been someone inside the palace. A court assassin, I’m sure of it! The work of the CRTP guild.”

I noted this carefully.

CRTP. Assassins of the royal court. Experts in privilege escalation and internal intrigue.

Holmes stared and responded. “Possibly.”

“Though I have occasionally observed, Inspector that when a palace is robbed the guards often assume adamantly the thief must have been a servant.”

Javert frowned and grumbled, “And of course you disagree?”.

Holmes glanced at the terminal.

“I merely find it premature to exclude the possibility of a professional killer who entered through the front gate.”

I closed my notebook.

“Holmes…”

“You mean Dr. OSCP Moriarty?”

Holmes allowed himself the faintest smile.

“Watson…”

“If Moriarty were involved we would not yet know.”

Holmes Begins

Holmes sat at the terminal.

“If we wish to understand how the assassins reached the princes,” he said, “we must begin where they began.”

He placed the cup beside the keyboard.

“With the city.”

Two commands appeared.

ip a
ip route

Holmes examined the output.

“The assassin has entered the city walls.”

“The first thing he does is study the roads.”

Which Houses Are Occupied

Holmes then tested which machines in the network were alive.

fping -asgq 192.168.56.0/24

Several addresses responded.

“Five,” I said.

Holmes shook his head.

“Four.”

He pointed to the first.

“VMware. The city wall.”

The remaining machines, Holmes explained, were houses within the city.

“When a machine answers,” he said, “it is the equivalent of knocking on a front door and hearing footsteps inside.”

“It tells the assassin the house is occupied.”

Inspector Javert crossed his arms.

“We performed this enumeration ourselves.”

Holmes nodded calmly.

“Of course.”

“The assassins did as well.”

Rooms and Servants

Holmes then began the next step.

nmap -p- --min-rate 5000 -T4 <hosts>

Lines of ports appeared across the screen.

“These,” Holmes said, “are the rooms.”

He then ran a second scan.

nmap -sV -sC <interesting ports>

Service names appeared beside them. Holmes tapped the screen.

“And these are the servants within those rooms.”

“The servants?” I asked.

“Indeed.”

“Kerberos.”

“LDAP.”

“SMB.”

“Each performs a duty within the household.”

He pointed toward Winterfell.

“The royal household.”

Inspector Javert frowned.

“All proper services.”

The Junior Analyst

At that moment a young analyst at the far console spoke hesitantly.

“Inspector… we could close them.”

The room turned.

“Close what?” Javert asked.

“The doors, sir.”

He gestured toward the display.

“Port 445. SMB. And DNS as well.”

“If attackers cannot reach them, they cannot enumerate the domain.”

Javert stared at him for several seconds. Then he rolled his eyes with the weary expression of a man who has just heard a proposal to improve a ship by removing the ocean.

Holmes chuckled softly.

“Watson,” he said.

“Would you care to explain?”

I cleared my throat.

“Well… the difficulty is that the palace itself depends upon these servants and guards.”

I pointed to the screen.

“SMB carries the documents of the kingdom. SYSVOL. NETLOGON. Group Policy. The instructions by which every machine, guard and servant in the court understands its duties.”

Holmes nodded approvingly.

“And DNS,” I continued, “is the directory of the city. It tells every citizen where the king resides. Without it, citzens cannot even locate the royal court.”

Holmes turned to the analyst.

“In short,” he said pleasantly, “closing SMB and DNS would indeed prevent the assassin from speaking with the servants.”

The young man brightened.

“It would also prevent the kingdom from functioning.”

The room grew quiet. Holmes gestured to the diagram.

“These services are not errors, dear Inspector. They are architecture. The palace requires them.”

Inspector Javert folded his arms.

“So the doors must remain open.”

Holmes smiled faintly.

“Precisely. Which means the assassin is not exploiting a mistake. He is simply using the palace exactly as it was designed.”

Holmes tapped the terminal.

“And that, Inspector…is why this investigation is interesting.”

Holmes’ Observation

Holmes worked quietly for several minutes.

Port scans.

Header checks.

Network surveys.

It looked less like hacking than like inspecting a great house — testing locks, checking windows, confirming which doors opened and which did not.

Eventually Holmes stopped typing. He studied the screen.

Inspector Javert spoke first.

“Well?”

Holmes did not look up.

“The assassins were patient.”

“What does that prove?” Javert asked.

Holmes tapped the desk.

“It proves they were still walking the perimeter.”

Javert frowned.

“My princes are dead. My servant is gone. My palace has been compromised. And you say nothing interesting has happened?”

Holmes stood and put on his coat.

“Yes.”

He gestured toward the scan results.

“This is only the survey of the house. The assassins have counted the windows. They have tested the doors. They have spoken to the servants.”

Holmes stopped.

“But they have not yet chosen the room where the murders occurred.”

Watson’s Notes

Holmes excused himself, leaving Javert and the officers in uneasy silence.

He was already halfway down the corridor when I glanced again at my notes.

They looked less like the record of an investigation and more like the outline of a professional networking article.

I had written:

Five Lessons from the Assassination of GOAD Every Executive Should Know

1️⃣ Know the city before the palace. 2️⃣ Identify which houses answer the door. 3️⃣ Walk the rooms and question the servants. 4️⃣ Elegant architecture is not the same as security. 5️⃣ Enumeration does not solve the crime — it merely reveals where the real investigation begins.

I stared at the page for a moment. The tone was suspiciously similar to the sort of polished analysis one might expect from IBM.

Or worse — from the automated writing engines currently filling the professional internet with cheerful mediocrity.

Holmes would have hated it. But the algorithm required posts of this sort to maintain engagement.

So naturally, I resolved to publish it later.