📋 TTX Readiness & Required Materials Checklist

🛡️ Pre-Exercise Setup, Communication Channels & Resource Checklist

1. 📢 Communication Channels & Contact Lists

2. 📜 Scenario Documents & Role Handbooks

3. 🖥️ Hardware, Visual Assets & Room Infrastructure

                                  [ MAIN PRESENTATION SCREEN ]
                                  (Runs index.html Portal & Mockups)
                                               │
               ┌───────────────────────────────┼───────────────────────────────┐
               ▼                               ▼                               ▼
       [ Facilitator Desk ]            [ SOC Operations Desk ]         [ Executive Command Desk ]
     - Facilitator Guide            - Laptops & SOP Playbooks       - Executive Escalation Sheet
     - Master Inject Clock          - ITSM / SIEM Mockup Access     - Legal & NBC Notification Forms
     - Scribe / Minute Notebook     - EDR Isolation Controls        - BCP Decision Matrix

4. 📝 Administrative, Scribing & Evaluation Materials

5. 🚀 Pre-TTX Kickoff Checklist (T-Minus 30 Minutes)

1. [ ] Confirm all participants are logged into the primary chat channel (#TTX-Ransomware-2026).

2. [ ] Test video/audio bridge if conducting a hybrid or virtual exercise.

3. ] Verify main presentation screen is displaying [index.html .

4. [ ] Distribute role handbooks to designated participants.

5. ] Deliver the SOC Team Briefing Slides ([soc_ttx_briefing_slides.md ) to set exercise ground rules and objectives.

6. [ ] Release Inject 1 and start the exercise master clock!

marp: true

theme: default

paginate: true

header: "🛡️ SOC Briefing | Ransomware Tabletop Exercise (TTX)"

footer: "Confidential - Cybersecurity Operations Center"

🛡️ SOC Team Briefing: Ransomware Tabletop Exercise (TTX)

🎯 Executive & Operational Orientation Slide Deck

Presenter: SOC Lead / Facilitator

Target Audience: SOC L1, SOC L2, SOC Lead/L3, SOC Manager, IR Communicator, CTI Team

Exercise Context: Off-site Phishing, C2 Beaconing, SMB Exfiltration & Ransomware Outbreak

Date: August 2026

📌 1. Why Are We Running This TTX?

Background & Operational Reality

🎯 Core Purpose: To test, evaluate, and refine our SOC Incident Response SOPs, detection capabilities, team escalation SLAs, and crisis communication in a simulated, zero-risk environment.

🎯 2. Core Exercise Objectives

📖 3. Scenario At A Glance: "ADMFI Ransomware Incident"

[ Telegram Phishing ] ──> [ Fake PDF Error ] ──> [ Silent C2 Connection ]
                                                            │
[ Shared Folder Encryption ] <── [ Data Exfiltration ] <── [ LAN Reconnection ]
            │
            ├──> 🚨 CrowdStrike EDR Critical Alert (Host Isolated)
            ├──> 📊 QRadar SIEM Event Correlation (Anomalous SMB Access)
            └──> 💀 Ransom Note Displayed ($50,000 USD Demand)

🎭 4. SOC Roles & Expectations Matrix

👨‍💻 5. Deep Dive: SOC L1 & SOC L2 Execution Responsibilities

🔹 SOC L1 Analyst (Tier 1 Duty)

1. Acknowledge & Validate: Confirm EDR alert (CrowdStrike) & SIEM correlation (QRadar) are True Positive.

2. Enrich Context: Gather Endpoint Name, IP address, User Account (sok.dara), Hash, and Alert Severity.

3. Log & Escalate: Create ITSM Ticket (#INC-2026-0814) with provisional SEV-1 rating and transfer to L2 in <15 minutes.

🔹 SOC L2 Analyst (Tier 2 Incident Lead)

1. Forensic Timeline: Reconstruct timeline from Telegram download → C2 beacon → LAN connection → SMB enumeration.

2. Execute Containment: Isolate infected endpoint in EDR console immediately.

3. Enforce Restrictions: Request AD account lock, active token revocation, C2 domain/IP firewall block, and SMB write restriction.

👔 6. Deep Dive: SOC L3, SOC Manager & IR Communicator

🔬 SOC Lead / L3 Analyst

👔 SOC Manager (Incident Commander)

💬 Incident Communicator

📜 7. Exercise Ground Rules & Mindset

1. Speak Up & Participate: Explain your actions step-by-step: "I am checking X log file, issuing Y command, and notifying Z role."

2. Focus on SOP Alignment: Reference our official playbooks (Ransomware SOP & Account Compromise SOP).

3. Challenge Assumptions: If a procedure is unclear, redundant, or missing authorization, raise it during the inject discussion.

4. No Real Production Impact: All actions discussed are hypothetical—no live systems will be disrupted.

🔄 8. SOC Response Workflow Summary

🏁 9. Post-TTX Deliverables & Next Steps

1. 📄 After-Action Report (AAR): Documenting key observations, SLA compliance, and technical findings.

2. 🛠️ SOP & Playbook Updates: Refining containment matrix, containment delegation authority, and communication templates.

3. 🎯 Detection Engineering Tuning: Adding custom EDR prevention rules and SIEM correlation alerts for double-extension files (.pdf.exe).

4. 📌 Action Item Tracking: Assigning clear ownership and deadlines for all identified gaps.

❓ Questions & Readiness Check

Are all SOC team members clear on their roles and objectives? Let's begin Inject 1!

🌳 "What If... / Then If..." Branching Injects & Decision Tree Guide

🛡️ Tabletop Exercise (TTX) Dynamic Decision Paths & Scenario Outcomes

🧭 Decision Tree Overview

📍 Phase 1: Off-site Telegram Payload Receipt

🔹 Branch 1A: EDR Auto-Quarantine (Best Case)

1. Malware execution fails; no persistence or C2 beacon is established.

2. EDR generates Alert #1042 (Medium Severity).

3. SOC L1 Action: Quarantines hash enterprise-wide and notifies Loan Department to issue warning about Telegram account @chanthy_loan_applicant.

4. Exercise Outcome: Incident contained at Phase 1. Proceed to Threat Hunting verification.

🔹 Branch 1B: Silent Persistence & Background C2 (Default Path)

1. Malware connects covertly to C2 IP 185.220.101.45:443.

2. Malware goes dormant, polling C2 every 60 seconds waiting for corporate domain ADMFI.LOCAL signal.

3. SOC L1 Action: No alert generated yet (stealth payload). Proceed to Phase 2 LAN Reconnection.

🔹 Branch 1C: Telegram Session & Credential Hijack (Plot Twist Variant)

1. Attacker steals active session tokens for Senior Loan Officer Sok Dara.

2. Attacker logs into Sok Dara's Telegram account and sends malicious payload .zip files to 30 other loan officers!

3. SOC L2 Action: Must execute immediate credential revocation, active session teardown, and internal broadcast warning.

📍 Phase 2: Corporate LAN Reconnection & SMB Scanning

🔹 Branch 2A: Host Isolation <5 Minutes (Ideal SOC Response)

1. Ransomware execution on Shared Drive is aborted mid-process.

2. Only 5 local files on Sok Dara's laptop are encrypted; corporate file server remains 100% clean.

3. Impact: Minor workstation re-image required. Incident resolved within 2 hours.

🔹 Branch 2B: Delayed Containment >30 Minutes (High Impact - Default)

1. Ransomware encrypts 12,000 files across 4 shared folders (Loan_Share$, HR_Share$, Finance_Share$) in 4 minutes.

2. File extension changes to .ADMFI_LOCKED.

3. EDR triggers CRITICAL SEV-1 alert; SOC Manager declares Major Incident & activates WAR Room.

🔹 Branch 2C: Pass-The-Ticket Domain Admin Escalation (Catastrophic Path)

1. Attacker deploys ransomware Domain-wide via Active Directory Group Policy Objects (GPO).

2. 45 workstations and 6 servers across Phnom Penh & Siem Reap branches freeze simultaneously.

3. CIO Action: Authorizes total isolation of corporate network and mandates full BCP/DR activation.

📍 Phase 3: Ransom Demand & Backup Restoration

🔹 Branch 3A: Immutable Backup Clean Restoration (Recovery Success)

1. CIO & CISO approve clean data restoration.

2. IT re-images laptop, wipes infected shared folders, and restores from immutable snapshot in 4 hours.

3. Ransom Outcome: Zero ransom paid. Operations restored cleanly.

🔹 Branch 3B: Shadow Copy & Secondary Backup Wipe (Plot Twist 2)

1. Local volume shadow copies and hot NAS backups are destroyed.

2. IT must fallback to off-site tape / cold cloud backup (RTO increases to 24-48 hours).

3. Executive Action: BCP Committee convenes to manage manual paper-based loan processing workarounds.

🔹 Branch 3C: Ransom Negotiation Dilemma

1. CISO & Legal advise that paying violates NBC cybersecurity compliance guidelines and OFAC sanctions.

2. Attacker provides test decryption key, but key fails on 40% of large database files (corrupt decryption).

3. Outcome: Financial loss without guaranteed data recovery.

📍 Phase 4: Double Extortion & Public Data Leak

🔹 Branch 4A: Telegram Public Customer Data Leak (Plot Twist 3)

1. Media and social media pick up the leak within 2 hours.

2. Legal & CISO Action: Mandatory notification to National Bank of Cambodia (NBC) and CamCERT within 24 hours.

3. PR Action: Release official press statement reassuring customers and setting up dedicated customer inquiry hotline.

🔹 Branch 4B: CTI Takedown & Managed Disclosure

1. Public exposure is contained to dark web leak site only (admfi-leaks.onion).

2. PR holds press statement while Legal fulfills NBC regulatory briefing requirements privately.

📊 Summary Decision Matrix for Facilitators

🇰🇭 របាយការណ៍សេណារីយ៉ូ Simulation Ransomware បែបខ្មែរ (Khmer-Style Cyber Ransomware TTX Scenario)

1. សង្ខេបសេណារីយ៉ូ (Executive Summary)

មន្ត្រីឥណទានជាន់ខ្ពស់ លោក សុខ ដារ៉ា នៃគ្រឹះស្ថានមីក្រូហិរញ្ញវត្ថុ ADMFI ប្រចាំរាជធានីភ្នំពេញ បានបំពេញភារកិច្ចជួបអតិថិជននៅក្រៅការិយាល័យ (Off-site) នៅហាងកាហ្វេមួយកន្លែង។ ដូចជាទម្លាប់ទូទៅនៃប្រតិបត្តិការឥណទាននៅកម្ពុជា មន្ត្រីឥណទានរូបនេះតែងតែប្រើប្រាស់ Telegram ដើម្បីទាក់ទង ផ្ញើ-ទទួល ឯកសារស្នើសុំកម្ចី អត្តសញ្ញាណប័ណ្ណ រូបថតទ្រព្យធានា និងប័ណ្ណកម្មសិទ្ធិដីធ្លី (ប្លង់រឹង/ប្លង់ទន់)។

ក្នុងអំឡុងពេលធ្វើការ លោក សុខ ដារ៉ា បានទទួលសារ Telegram ពីអតិថិជនថ្មីម្នាក់ដែលប្រើប្រាស់ឈ្មោះ "លោកស្រី គឹម ចាន់ធី" ដោយបានផ្ញើ file ឈ្មោះ ឯកសារ_ស្នើសុំ_ឥណទាន_២០២៦.zip។ ប៉ុន្តែ នៅក្នុង zip file នោះមាន file បង្កប់កូដមេរោគ (Malware Exe) ដែលក្លែងបន្លំជា file PDF ឈ្មោះ លក្ខខណ្ឌ_កម្ចី_អតិថិជន.pdf.exe។

នៅពេលលោក ដារ៉ា ចុចបើក file នោះ កម្មវិធីបានបង្ហាញផ្ទាំង Error ក្លែងក្លាយថា "មិនអាចបើកឯកសារ PDF បានទេ ដោយសារឯកសារខូច (Corrupted File)"។ ដោយគិតថាអតិថិជនផ្ញើ file ខូច លោក ដារ៉ា ក៏បានរំលង ហើយបន្តធ្វើការធម្មតា។ ប៉ុន្តែនៅពីក្រោយខ្នង មេរោគបានចាប់ផ្តើម run ដោយស្ងាត់ៗ ជ្រែកចូលប្រព័ន្ធ laptop របស់លោក ដារ៉ា និងភ្ជាប់ទំនាក់ទំនងទៅកាន់ attacker Command & Control (C2) Server។

លុះរសៀលឡើង លោក ដារ៉ា បានត្រឡប់មកកាន់ការិយាល័យកណ្តាល ADMFI (Head Office) ហើយបានដោតខ្សែបណ្តាញ LAN ចូលទៅក្នុងបណ្តាញផ្ទៃក្នុង (Corporate Network 10.20.0.0/16)។ ភ្លាមៗនោះ មេរោគ Ransomware បានដឹងថា laptop បានភ្ជាប់ចូលបណ្តាញធនាគារ ហើយវាបាន៖

1. ស្វែងរក Shared Drives របស់នាយកដ្ឋានឥណទាន (\\ADMFI-FS01\Loan_Share$)

2. បំពានសិទ្ធិ (Abuse Authenticated Token) របស់លោក ដារ៉ា ដើម្បីលួចទិន្នន័យអតិថិជន (Data Exfiltration) ផ្ញើទៅ C2 Server

3. ចាប់ផ្តើម Encrypt (សរសេរកូដចោរ) លើរាល់ឯកសារទាំងអស់នៅលើ Laptop និង Shared Folder របស់ក្រុមឥណទាន ដោយប្តូរ extension ទៅជា .ADMFI_LOCKED

4. បង្ហាញ Ransom Note ទារប្រាក់ចំនួន $50,000 USD ជា Bitcoin/USDT។

2. តួអង្គ និង ក្រុមការងារក្នុងសេណារីយ៉ូ (Key Persona & Roles)

3. លំហូរនៃការវាយប្រហារ (Attack Progression Flowchart)

4. ដំណើរការឆ្លើយតបអាសន្ន SOP (Incident Response SOP Flowchart)

5. ប្រធានបទ និង ចោទសួរសម្រាប់ពិភាក្សា (TTX Discussion Injects)

🔹 Inject 1: បញ្ហាប្រឈមនៃការប្រើប្រាស់ Telegram ក្នុងប្រតិបត្តិការឥណទាន (Off-site Work Risks)

1. តើត្រូវកំណត់សម្រេចយ៉ាងណា ចំពោះការអនុញ្ញាត ឬ ហាមឃាត់ការទាញយក file ពី Telegram ចូលក្នុង Laptop ក្រុមហ៊ុន?

2. ប្រសិនបើអតិថិជនផ្ញើ file .zip ឬ .rar តើប្រព័ន្ធសុវត្ថិភាពអុីមែល ឬ Endpoint Defender គួរតែធ្វើការទប់ស្កាត់ដោយស្វ័យប្រវត្តិដែរឬទេ?

🔹 Inject 2: ការទប់ស្កាត់ពេល Ransomware ចាប់ផ្តើម encrypt file លើ Shared Drive

1. តើ SOC L1/L2 មានសិទ្ធិអំណាចពេញលេញក្នុងការ Isolate Laptop របស់លោក ដារ៉ា ដោយមិនបាច់រង់ចាំការយល់ព្រមពី Business Owner ដែរឬទេ?

2. តើត្រូវធ្វើដូចម្តេចដើម្បីការពារ Shared Drives ផ្សេងទៀត (ដូចជា HR, Finance, Core Banking Backups) មិនឲ្យរលាលឆ្លងដល់?

🔹 Inject 3: ការគ្រប់គ្រងវិបត្តិ និង កាតព្វកិច្ចច្បាប់/បទប្បញ្ញត្តិ (NBC Compliance & Data Leak)

1. តើធនាគារ ADMFI មានគោលការណ៍ "មិនបង់ប្រាក់លោះ (No-Ransom Policy)" ដែរឬទេ?

2. តើនាយកដ្ឋានច្បាប់ និង CISO ត្រូវរាយការណ៍ជូន ធនាគារជាតិនៃកម្ពុជា (NBC) និង CamCERT ក្នុងរយៈពេលប៉ុន្មានម៉ោងបន្ទាប់ពីដឹងថាមានទិន្នន័យលេចធ្លាយ?

3. តើត្រូវឆ្លើយតបនឹងសារព័ត៌មាន (Public Relations) យ៉ាងដូចម្តេច ប្រសិនបើព័ត៌មាននេះលេចធ្លាយលើបណ្តាញសង្គម Facebook/Telegram?

6. សូចនាករបច្ចេកទេសនៃការវាយប្រហារ (Technical IOCs Table)

7. តារាង RACI Matrix សម្រាប់ Incident Response (ADMFI Context)

🛡️ TTX Ransomware Exercise Scenario

Summary

Loan officers regularly work off-site to meet customers and primarily use Telegram to communicate and exchange loan applications, contracts, identification records, and supporting documents. He receives a compressed archive named Customer_Documents_2026.zip through Telegram from what appears to be a legitimate customer. The archive contains a malicious executable disguised as a PDF document.

The employee extracts the archive and opens the apparent PDF file. A fake document error appears, leading the employee to assume that the customer sent a corrupted document. No administrator credentials are requested, and no software installation window appears. The employee ignores the error and continues working.

Behind the fake error message, malware begins running silently under the employee's standard user account. It establishes user-level persistence, communicates with attacker-controlled command-and-control infrastructure, and waits for access to the corporate environment.

Later, the employee returns to the office and reconnects the infected laptop to the corporate LAN. The malware detects the corporate network and begins several activities in parallel, It discovers accessible Loan Team file shares and abuses the employee's existing authenticated access. It collects sensitive loan and customer documents and attempts to exfiltrate them. It targets available authentication information and attempts to access other systems authorized to the employee. After completing its initial discovery and data-collection activities, the attacker activates the ransomware. The ransomware begins encrypting files stored locally on the Loan Team laptop and documents within accessible Loan Team shared folders.

EDR detects the ransomware behavior and generates a critical alert. At the same time, the SIEM receives and correlates multiple security events from EDR, the firewall, Active Directory, and file servers. These events indicate suspicious external communication, abnormal authentication activity, unusually high file access, and rapid modification of shared documents.

The employee's laptop becomes unresponsive and displays a ransom note. The employee reports the issue to the Help Desk, while the SOC begins reviewing the EDR and SIEM alerts. The SOC validates the ransomware activity, contains the affected endpoint and identity, activates the Incident Response process, assesses the potential impact on Loan Team file shares and customer data, and informs cybersecurity and management stakeholders.

Scenarios Flow

Responding Action

Response Action (SOP Aligned)

What action should do when ransomware happend, ensure SoP is follow.

📖 The Ransomus Protocol: An Interactive Cyber Crisis Storybook

A Narrative Tabletop Exercise Book with Dramatic Plot Twists, Character Interrogations, and Visual Incident Mockups.

Incident Response Command Team

📘 Prologue: The Anatomy of a Modern Cyber Attack

It was a rainy Tuesday morning at Loan Corp Headquarters. Loan officers operated on the frontlines of commercial lending, constantly closing high-value mortgage deals and business credit lines. To stay nimble in a hyper-competitive market, loan officers frequently met VIP clients off-site at coffee shops, hotel lobbies, and remote branches.

To expedite documentation exchanges, loan officers relied heavily on corporate Telegram desktop channels—a convenient, unsanctioned shadow IT channel for sending signed PDF applications, tax records, and identity archives.

Unbeknownst to the team, a sophisticated nation-state threat group known as Ransomus was monitoring these informal channels, waiting for the perfect moment to slip through the castle gates...

📸 Chapter 1: The Telegram Phishing Payload & Disguised Execution

Telegram Phishing Vector

📖 The Narrative

At 09:15 AM, Alex, a senior commercial loan officer, was working remotely from a downtown coffee shop. A notification popped up on his Telegram app from a verified customer contact profile named "VIP Client - Horizon Real Estate".

Attached was a compressed archive titled Customer_Documents_2026.zip (size: 42 MB). The message read:

"Alex, attached are our signed commercial loan agreements and bank statements for the $12M property acquisition. Please review urgently before noon!"

Eager to close the deal, Alex extracted the archive. Inside was a file with a familiar Adobe PDF icon named Signed_Agreement.pdf.exe. Double-clicking it triggered a brief spinner, followed by a Windows system error dialog:

Fake Adobe PDF Error

System Error: Adobe Acrobat Reader DC - Unable to render document format (0x80070005). File may be corrupted.

Alex assumed the client sent a broken file, closed the error box, sent a quick Telegram message asking for a resend, and moved on to other emails.

Behind the screen, the trap was sprung. The disguised executable silently injected a malicious DLL into svchost.exe, established user-level registry persistence, and initiated encrypted HTTPS beacons to 185.123.45.6:443.

🌀 Dramatic Plot Twist 1: The Insider Credentials Leak

TWIST: The Telegram profile that sent the file belonged to an actual high-value client whose personal Telegram account had been hijacked 24 hours earlier! Furthermore, EDR telemetry reveals that the Trojan payload harvested Alex's saved Active Directory credentials and Chrome browser tokens during the error popup!

❓ Hot-Seat Character Interrogation Questions (Chapter 1)

Character Role	Hot-Seat Twist Question for the Player
SOC L1 SOC L1 Analyst	"An EDR alert fires for LOAN-LAPTOP-042 showing an unrecognized process spawn (explorer.exe -> Signed_Agreement.exe -> svchost.exe). The user reports it as a harmless Adobe glitch. Do you dismiss it as a False Positive or escalate? What is your 15-minute SLA protocol?"
SOC L2 SOC L2 Analyst	"The malware did not request admin privileges and ran under standard user permissions (j.smith). How do you validate whether this is a commodity Trojan or an targeted APT payload?"
CTI Team CTI Team Analyst	"Threat intel links IP 185.123.45.6 to a known ransomware syndicate. What campaign indicators do you immediately feed to L1/L2?"

🗺️ Chapter 2: The Corporate LAN Reconnection & Silent Reconnaissance

Global Cyber Threat Map

📖 The Narrative

By 02:00 PM, Alex finished his off-site meetings and returned to corporate headquarters. He sat down at his desk and plugged LOAN-LAPTOP-042 directly into an Ethernet jack connected to the corporate LAN.

The moment the laptop obtained an internal IP (10.15.34.120), the dormant malware spirit detected the corporate domain controller (AD-DC01).

Exploiting Alex's existing Kerberos session tokens, the Trojan launched automated network reconnaissance. It mapped accessible network shares, discovered \\FS01\LoanShares, and performed Kerberoasting queries to harvest service account ticket hashes.

🌀 Dramatic Plot Twist 2: The Unpatched Domain Controller

TWIST: The attacker utilizes the compromised j.smith account to query Active Directory for Domain Admin service accounts. The SOC discovers that AD-DC01 is missing a critical patch for a known privilege escalation vulnerability (CVE-2026-1102), allowing a standard user account to request elevated Kerberos TGS tickets!

❓ Hot-Seat Character Interrogation Questions (Chapter 2)

Character Role	Hot-Seat Twist Question for the Player
Network System Network & System Team	"Active Directory reports 50+ Kerberos TGS requests per second originating from LOAN-LAPTOP-042. Do you instantly isolate the network switch port or wait for SOC Manager approval?"
Business Owner Business / Asset Owner	"The network team proposes isolating \\FS01\LoanShares. This will halt 200 loan officers nationwide from closing deals today. Do you authorize this operational freeze?"
SOC Manager SOC Manager	"L2 requests host isolation for LOAN-LAPTOP-042 and account lockout for j.smith. Who holds mandatory operational authority to approve this action under the RACI matrix?"

📊 Chapter 3: The 5GB Exfiltration Shadow & SIEM Alarm

IBM QRadar SIEM Dashboard

📖 The Narrative

At 02:25 PM, the attacker activated the exfiltration module. Compressed archives containing 5.2 GB of confidential customer loan applications, tax filings, and corporate financial statements were staged in C:\Users\j.smith\AppData\Local\Temp\enc_payload.dll.

The malware opened multi-threaded SSL/TLS outbound streams, pushing the siphoned data to external C2 server 185.123.45.6:443.

At 02:28 PM, the IBM QRadar SIEM console flared red. A CRITICAL SEV-1 Offense #48291 correlated multiple anomalies:

1. Palo Alto Firewall: Outbound HTTPS data spike (5.2 GB to uncategorized IP 185.123.45.6).

2. Active Directory: Abnormal Kerberos TGS ticket request burst under j.smith.

3. File Server FS01: High-volume file read operations on \\FS01\LoanShares.

4. Loan Application System (LOS): Bulk customer record export event.

🌀 Dramatic Plot Twist 3: The Media Extortion Threat

TWIST: Simultaneously, the CTI team uncovers a post on a dark web leak site where the Ransomus group claims they have already exfiltrated 5,000 customer PII records and threatens to leak them to financial news media in 2 hours if contact is not made!

❓ Hot-Seat Character Interrogation Questions (Chapter 3)

Character Role	Hot-Seat Twist Question for the Player
SOC Lead SOC Lead / L3	"SIEM shows 5.2 GB of data exfiltrated in 3 minutes. How do you determine whether customer PII was included in the exfiltration bundle versus internal system logs?"
IR Communicator Incident Communicator	"A tech journalist calls your press desk asking if Loan Corp is experiencing a ransomware data breach. How do you respond without violating executive communication SLAs?"
CISO CISO	"Dark web extortion claims 5,000 customer records were stolen. At what point does regulatory data breach notification (e.g., GDPR / SEC / banking regulators) become mandatory?"

🔒 Chapter 4: The Encryption Catalyst & HelpDesk Midnight Call

CrowdStrike EDR Alert Console

📖 The Narrative

At 02:32 PM, having completed data exfiltration, the attacker launched the ransomware payload.

Using multi-threaded AES-256 encryption, the malware began locking local files on LOAN-LAPTOP-042 and rapidly traversed network shares on \\FS01\LoanShares. Thousands of documents, spreadsheets, and database backups were renamed with a .lock extension.

Seconds later, CrowdStrike EDR triggered a CRITICAL SEV-1 ALERT: Ransomware Execution & Mass File Encryption Detected.

Alex's Dell laptop froze completely. The display transformed into a terrifying blood-red lock screen:

Dell Laptop Ransomware Lock Screen

RANSOM LOCK NOTICE: ALL YOUR FILES HAVE BEEN ENCRYPTED BY RANSOMUS! A unique encryption key has locked access. Submit 5.0 BTC (~$325,000 USD) to wallet 1F1tAaz5x1HUXrCNLvtMDqcw6955Hnt9Dk within 72 hours or the key will be permanently destroyed!

🌀 Dramatic Plot Twist 4: The Corrupted Shadow Copies

TWIST: When system administrators attempt to trigger local Volume Shadow Copies (VSS) on FS01, they discover the ransomware executed vssadmin delete shadows /all /quiet via a compromised Domain Admin service account prior to encryption!

❓ Hot-Seat Character Interrogation Questions (Chapter 4)

Character Role	Hot-Seat Twist Question for the Player
SOC Manager SOC Manager	"Local shadow copies on FS01 are wiped and the ransomware note demands 5 BTC. Do you immediately declare a Major SEV-1 Incident and invoke the Business Continuity Plan (BCP)?"
Executive Executive Management	"A board member asks if the company should pay the 5 BTC ransom to regain immediate access before market opening. What is executive policy regarding ransom negotiations?"
CIO CIO	"Core lending databases are locked. Who holds final authority to sign off on BCP disaster recovery invocation when core core systems are compromised?"

🏛️ Chapter 5: The Incident Command WAR Room & Multi-Team Containment

Incident Command WAR Room

📖 The Narrative

At 02:45 PM, the SOC Manager formally declared a SEV-1 Major Incident.

The Incident Communicator immediately launched the central Incident Command WAR Room, bringing together all 11 role stakeholders: SOC Analysts, Forensics, IT Infrastructure, Threat Intel, Asset Owners, CIO, CISO, and Executive Leadership.

4 parallel containment streams were initiated:

1. Network Containment: Block IP 185.123.45.6 at the perimeter firewall and isolate LOAN-LAPTOP-042.

2. Identity Lockdown: Disable AD account j.smith, reset Kerberos krbtgt tickets, and terminate active SMB sessions.

3. Application Guard: Place \\FS01\LoanShares into Read-Only Mode while forensic volatile memory capture was executed.

4. Executive Briefings: Issue 30-minute status updates to CISO, CIO, and legal counsel.

🌀 Dramatic Plot Twist 5: The Secondary Persistence Backdoor

TWIST: During network containment, Network Ops notices HTTPS traffic to a SECOND unknown IP (198.51.100.42) originating from a totally different server (WEB-APP-02)! The attacker installed a web shell 3 days prior as a secondary fallback persistence mechanism!

❓ Hot-Seat Character Interrogation Questions (Chapter 5)

Character Role	Hot-Seat Twist Question for the Player
IR Communicator Incident Communicator	"The CISO demands an instant update while Network Ops discovers a secondary web shell backdoor. Does the Incident Communicator have authority to execute containment actions? How do you manage stakeholder comms?"
Network System Network & System Team	"SOC L2 requests severing WEB-APP-02 from the internet. This will take the customer online portal offline. How quickly can your team execute this isolation?"
Business Owner Business / Asset Owner	"With WEB-APP-02 and FS01 offline, what manual paper fallback procedures does your business unit initiate to maintain loan processing?"

🧹 Chapter 6: The Immutable Restoration & Executive Return-to-Production

Backup Restoration Portal

📖 The Narrative

By Day 2 at 08:00 AM, eradication activities were fully underway.

The Network & System Team reimaging LOAN-LAPTOP-042 with an approved gold image, purged the web shell on WEB-APP-02, patched CVE-2026-1102 on AD-DC01, and verified EDR sensor health across all endpoints.

Engineers accessed the immutable offline backup vault and located an uncorrupted snapshot taken at 02:00 AM on Day 1 (prior to infection). Restoration reached 98% completion by 02:00 PM.

At 04:00 PM, the Business Asset Owner validated data integrity across restored shares. Finally, in a joint executive session, the CIO and CISO granted formal recovery authorization to return systems to production.

🌀 Dramatic Plot Twist 6: The 2-Hour Backup Gap & Missing Deals

TWIST: Data validation reveals that loan contracts created between 07:00 AM and 09:00 AM on Day 1 were not captured in the 02:00 AM snapshot. 14 high-value loan agreements must be manually re-entered from paper receipts!

❓ Hot-Seat Character Interrogation Questions (Chapter 6)

Character Role	Hot-Seat Twist Question for the Player
Business Owner Business / Asset Owner	"14 loan contracts are missing from the restored snapshot. How do you validate manual re-entry accuracy before confirming operational recovery to the CIO/CISO?"
CIO CIO	"Under governance SOPs, what mandatory sign-off criteria must be satisfied before you and the CISO authorize returning core systems to production?"
CISO CISO	"Post-Incident Review (PIR) identifies 5 overdue remediation items. How does the CISO enforce accountability and tracking for overdue action items?"

📊 Summary of Character RACI Powers & Story Arc

🎓 Facilitator Epilogue & Key Takeaways

1. RACI Enforcement: Containment authority must strictly align with pre-approved matrix boundaries to eliminate operational bottlenecks.

2. Communication Velocity: Incident Communicators own stakeholder notification and WAR Room management, ensuring technical teams remain focused on containment.

3. Immutable Snapshots: Offline, air-gapped backups are the single critical line of defense against ransomware extortion.

4. Joint Executive Blessing: Production restoration requires formal sign-off from both business and security leadership (CIO & CISO).

🚀 Run the Interactive Deck: Open index.html to present full-screen slides or launch the D&D campaign mode!

🐉 Cyber & Dragons: The Ransomus Campaign

🎲 Tabletop Exercise (TTX) D&D Style Facilitator & Campaign Master Guide

📌 Campaign Overview

Welcome, Dungeon Master (Facilitator)! This guide transforms standard cybersecurity Incident Response (IR) tabletop exercises into an immersive Dungeons & Dragons (D&D) style fantasy tabletop roleplaying campaign.

Players assume the roles of an elite Cyber Adventuring Party battling Ransomus the Encryptor—a dark threat spirit attempting to siphon customer archives and freeze corporate systems with ransomware crystals.

⚔️ The 11 Character Class Roles & RACI Spells

Each participant receives a Character Card with specific RACI abilities, stats, and containment spells:

🎲 Core Game Mechanics for the Dungeon Master (DM)

1. Boss Health Pool: Ransomus starts with 10,000 HP. Each successful encounter roll depletes Boss HP.

2. Initiative Order: Turn proceeds sequentially through Encounters I to VI.

3. Skill Checks & D20 Rolls:

4. DM Storytelling Rule: Read the Dungeon Master Script aloud for each encounter before prompting players to respond with their role handbooks!

🎬 The 6 Quest Encounters (Start-to-Finish Script)

📜 Encounter I: The Mimic's Scroll (Phishing Vector)

🗣️ Dungeon Master Script (Read Aloud):

"Hark, brave adventurers! A remote loan officer working outside the castle walls receives a sealed parchment named Customer_Documents_2026.zip over the Telegram messaging network. Believing it to be a legitimate loan applicant, the officer opens Signed_Agreement.pdf—a dark executable in disguise! A cursed Adobe error (0x80070005) flashes across his screen. The officer ignores the warning and continues working. Behind the error, a silent Trojan spirit awakens and beacons back to the dark domain!"

🎯 Party Objective & Challenge:

🌐 Encounter II: Infiltration of Loan-Keep LAN (Lateral Recon)

🗣️ Dungeon Master Script (Read Aloud):

"The loan officer returns to HQ and plugs LOAN-LAPTOP-042 directly into the corporate LAN! Like shadow tendrils, the malware spirit crawls across the internal realm. It enumerates Active Directory domain controllers (AD-DC01), abuses existing Kerberos tokens under account j.smith, and discovers the ancient vault of customer file shares (\\FS01\LoanShares)!"

🎯 Party Objective & Challenge:

📤 Encounter III: The Mass Exfiltration Ritual (5GB Data Drain)

🗣️ Dungeon Master Script (Read Aloud):

"Dark magic surges! An dark portal opens to external realm 185.123.45.6:443. Ransomus begins siphoning 5GB of sensitive customer loan archives over encrypted channels! The IBM QRadar SIEM crystal glows bright red, triggering dual alarms: Outbound Data Exfiltration Spike + Abnormal SMB Read Burst!"

🎯 Party Objective & Challenge:

🔒 Encounter IV: Curse of Encryptus (Ransomlock)

🗣️ Dungeon Master Script (Read Aloud):

"Ransomus strikes with full fury! Dark encryption crystals freeze workstation files and shared vaults (\\FS01\LoanShares) with .lock extensions! Alex's Dell laptop freezes, displaying a blood-red ransom note: '5 BITCOIN DEMANDED WITHIN 72 HOURS OR ALL KEYS DESTROYED!' CrowdStrike EDR roars with a CRITICAL SEV-1 ALERT!"

🎯 Party Objective & Challenge:

🛡️ Encounter V: War Room Summit & Elemental Barrier (Containment)

🗣️ Dungeon Master Script (Read Aloud):

"The alarm bells ring! War Room Bard blows the SLA Horn of Emergency, gathering all 11 heroes into the Incident Command WAR Room! Executive notifications shoot across the realm to Lord Chancellor CIO and Grand Inquisitor CISO within 15 minutes. Dwarven Technomancers slam the firewall gates shut!"

🎯 Party Objective & Challenge:

✨ Encounter VI: Divine Purge & Clean Restoration (Eradication & Recovery)

🗣️ Dungeon Master Script (Read Aloud):

"VICTORY IS WITHIN REACH! The infected laptop is cleansed and reimaged with gold armor. Technomancers cast Holy Restoration, pulling a 98% clean immutable snapshot from the backup vaults! Guild Asset Overseer inspects the restored archives and confirms operational integrity. Lord Chancellor CIO and Grand Inquisitor CISO raise their staves to grant final blessing!"

🎯 Party Objective & Challenge:

📊 Evaluation Rubric & Victory Rewards (Loot)

📑 Post-Campaign Debriefing Checklist (PIR)

📊 Executive Briefing Presentation Deck (.pptx)

📑 Slide Deck Table of Contents

Slide 1: Executive Title & TTX Scenario Briefing (ADMFI Microfinance)
Slide 2: Operational Reality & Off-Site Risk Context
Slide 3: 11-Role RACI Authority & Containment Matrix
Slide 4: End-to-End Threat Kill-Chain & Architecture
Slide 5: Inject 1 — Telegram Social Engineering & Fake PDF Error
Slide 6: Inject 2 — Corporate LAN Reconnection & Kerberos Recon
Slide 7: Inject 3 — 5.2GB Customer Data Exfiltration & SIEM Correlation
Slide 8: Inject 4 — Ransomware Detonation ($50,000 Extortion Demand)
Slide 9: Plot Twists (Telegram BEC Hijack, VSS Wiper, Dark Web Leak)
Slide 10: Inject 5 — Major Incident WAR Room & 4-Pillar Containment
Slide 11: Inject 6 — Forensic Eradication & Immutable Snapshot Recovery
Slide 12: Post-Incident Review (PIR), KPI Rubric & Continuous Improvement