🐼Jade Palace Cyber Mystery

🧩 Jade Palace – Game Master Cheat Sheet

🎮 Game Summary (KC7 Platform)

Scenario Premise: Po is confused after being unexpectedly defeated by Tai Lung. He had trained hard and even developed secret techniques, which he logged privately on his device. The defeat raises suspicions—how did Tai Lung know his moves?

Technical Investigation (in KC7):

• Students analyze email logs and file activity.

• They discover that Po clicked a link in an email from “BadLeopard.”

• This led to the download of a suspicious file, suggesting malware execution.

• Additional evidence from Master Shifu’s machine shows lateral movement and further compromise.

• Students begin forming a theory of how Po’s secret moves were leaked.

🧾 How the Physical Artifacts Fit In

While students are digging through KC7 logs, they also move through the room collecting physical artifacts that expand the narrative and help identify the people behind the breach. These artifacts allow students to bridge the “what happened” (KC7 data) with the “who and why” (real-world motives and context).

Artifact	Purpose / Narrative Tie-In
Po’s Notes on Secret Moves	Confirms Po was documenting techniques digitally—likely the target of the breach
Tai Lung Email Printout	The phishing email Po clicked; visually reinforces the phishing storyline
LeopardFanBlog Post	Builds character background; hints at obsession or inside knowledge
Poster for Kung Fu Legends Tryouts	Likely the lure used in the phishing email; explains the pretext
Confidential Tournament Entry	Suggests identity spoofing or unfair access to Po’s information
Daily Schedule of Training Sessions	Can help determine timeline and opportunity for espionage
Tournament Judges List	Could reveal conflict of interest or compromised insider
Witness Statement - Monkey	Offers an unreliable narrator or side clues to triangulate evidence
Case Manager Packet	The main worksheet for teams to track progress and summarize findings
Criminal Referral Form	Where teams formally name two suspects (Subject A and B) and explain why

🔍 Investigation Flow (Suggested)

Here’s a recommended flow of how students should approach the challenge:

1. Begin with KC7 Investigation

   • Identify the email Po clicked

   • Find the downloaded file and malware activity

   • Look for signs of lateral movement to Shifu’s account

2. Assign Team Roles

   • Case Manager, Investigator, Presenter, Analyst

3. Search for Physical Clues

   • Teams explore the room to gather documents

   • They compare these artifacts with what they saw in KC7

4. Fill Out Case Packet + Referral Form

   • Evidence is organized in the Case Manager Packet

   • Attribution decision is made in the Criminal Referral Form

5. Present or Submit Conclusions

   • Teams explain how the attack happened and who was responsible

---

👨‍🏫 Facilitator Tips

• Don’t rush students. The real challenge is connecting logs to human motives—this takes time.

• Encourage citing evidence. When teams name suspects, ask “what makes you say that?”

• Keep the energy high. Move between groups, prompt questions, and highlight creative thinking.

• Add layers. Use props, music, or classroom lighting to make the atmosphere feel like a dojo or investigation war room.