# 🛡️ TTX Ransomware Exercise Scenario

> [!TIP]
> 📖 **Interactive Storybook**: Read [`ttx_story_book.md`](ttx_story_book.md) for chapter prose, dramatic plot twists, character twist questions, and visual assets.
> 🐉 **D&D Style Campaign Guide**: See [`dnd_campaign_guide.md`](dnd_campaign_guide.md) for full start-to-finish gamified roleplay scripts and D20 dice mechanics.
> 📊 **PowerPoint Presentation**: Download [`Ransomware_Incident_TTX_Presentation.pptx`](Ransomware_Incident_TTX_Presentation.pptx) for executive briefings.
> 🚀 **Interactive TTX Portal & Slide Deck**: Open [`index.html`](../index.html) in your browser for full-screen slide presentations and interactive injects.
> 🎓 **Facilitator Guide**: See [`facilitator_guide.md`](../guides/facilitator_guide.md) for step-by-step facilitator scripts and discussion prompts.
> 🎭 **Role Cards**: Explore character roles in [`roles/`](../roles/).
> 📸 **Visual Screenshots**: View high-resolution threat mockups in [`assets/`](../assets/).

## Summary
Loan officers regularly work off-site to meet customers and primarily use Telegram to communicate and exchange loan applications, contracts, identification records, and supporting documents. He receives a compressed archive named Customer_Documents_2026.zip through Telegram from what appears to be a legitimate customer. The archive contains a malicious executable disguised as a PDF document.

The employee extracts the archive and opens the apparent PDF file. A fake document error appears, leading the employee to assume that the customer sent a corrupted document. No administrator credentials are requested, and no software installation window appears. The employee ignores the error and continues working.

Behind the fake error message, malware begins running silently under the employee's standard user account. It establishes user-level persistence, communicates with attacker-controlled command-and-control infrastructure, and waits for access to the corporate environment.

Later, the employee returns to the office and reconnects the infected laptop to the corporate LAN. The malware detects the corporate network and begins several activities in parallel, It discovers accessible Loan Team file shares and abuses the employee's existing authenticated access. It collects sensitive loan and customer documents and attempts to exfiltrate them. It targets available authentication information and attempts to access other systems authorized to the employee. After completing its initial discovery and data-collection activities, the attacker activates the ransomware. The ransomware begins encrypting files stored locally on the Loan Team laptop and documents within accessible Loan Team shared folders. 

EDR detects the ransomware behavior and generates a critical alert. At the same time, the SIEM receives and correlates multiple security events from EDR, the firewall, Active Directory, and file servers. These events indicate suspicious external communication, abnormal authentication activity, unusually high file access, and rapid modification of shared documents.

The employee's laptop becomes unresponsive and displays a ransom note. The employee reports the issue to the Help Desk, while the SOC begins reviewing the EDR and SIEM alerts. The SOC validates the ransomware activity, contains the affected endpoint and identity, activates the Incident Response process, assesses the potential impact on Loan Team file shares and customer data, and informs cybersecurity and management stakeholders.

## Scenarios Flow
```mermaid
flowchart TD
    A["👨‍💼 Loan works off-site<br/>📱 Telegram for Comm."]
    B["🎣 Fake customer sends<br/>📦 Customer_Doc_2026.zip"]
    C["⚠️ He opens file<br/>❌ Got error but ignored"]
    D["🦠 Malware run silently<br/>🌐 Connect to C2"]
    E["🏢 He returns office<br/>🔌 Connects PC to LAN"]
    F["📂 Malware got FileShare<br/>🔑 Abuses Auth access"]
    G["📑 Loan/customer Info<br/>📤 Collected & exfiltrated"]
    H["🖥️ Attacker attempts on <br/>➡️ Other internal systems"]
    I["🔒 Ransomware encrypts<br/> Loan PC & Shared Folders"]
    J["🛡️ EDR detects Ransom<br/>🚨 Critical SecAlert"]
    K["📊 SIEM/Firewall/AD/FileShare<br/>⚡ Multiple alerts"]
    L["💀 Laptop freezes<br/>💰 Ransom note appears"]
    M["☎️ Employee reports<br/>🛠️ HelpDesk"]
    N["👮 SOC Triage/containt<br/>🚨 IR Activated<br/>📢 Inform Management"]

    A --> B --> C --> D --> E
    E --> F --> I
    E --> G --> I
    E --> H --> I

    I --> J --> L
    I --> K --> L
    L --> M --> N

    classDef user fill:#E8F1FB,stroke:#2F75B5,color:#17365D;
    classDef threat fill:#FCE4D6,stroke:#C00000,color:#7F0000;
    classDef internal fill:#FFF2CC,stroke:#BF8F00,color:#7F6000;
    classDef detect fill:#E2F0D9,stroke:#548235,color:#375623;
    classDef response fill:#E4DFEC,stroke:#7030A0,color:#3F1D5A;

    class A,C,M user;
    class B,D,F,G,H,I threat;
    class L internal;
    class J,K detect;
    class N response;
```
## Responding Action
```mermaid
flowchart TD

%% ==========================
%% Detection
%% ==========================
subgraph P1["🛡️ Phase 1 - Detection & Validation"]
direction TB
A["🚨 EDR / SIEM Alert<br/>☎️ User Report"]
B["👨‍💻 L1 validates & enriches alert"]
C["📝 ITSM Incident Created<br/>⚠️ Provisional SEV1"]
D["📞 L2 notified<br/>⏱️ Within 15 minutes"]

A --> B --> C --> D
end

%% ==========================
%% Containment
%% ==========================
subgraph P2["🚒 Phase 2 - Initial Containment"]
direction TB
E["📚 Invoke Ransomware &<br/>Account Compromise Playbooks"]
F["📸 Capture volatile evidence<br/>while containment begins"]
G["🔌 Isolate endpoint<br/>🔑 Revoke user sessions"]
H["🌐 Block C2 traffic<br/>📂 Stop File Server sessions"]

E --> F --> G --> H
end

%% ==========================
%% Crisis Management
%% ==========================
subgraph P3["👔 Phase 3 - Crisis Management"]
direction TB
I["🚨 SOC Manager declares<br/>Major Incident"]
J["💬 Incident Communicator<br/>Creates WAR Room"]
K["📢 Notify CISO, CIO & Cybersecurity Head<br/>⏱️ Within 15 minutes"]

I --> J --> K
end

%% ==========================
%% Investigation
%% ==========================
subgraph P4["🔍 Phase 4 - Investigation"]
direction TB
L["🧭 L2 scopes affected<br/>Endpoints, Identities,<br/>Data & Infrastructure"]
M["🎯 CTI & Threat Hunting<br/>Search enterprise-wide"]
N["🤝 Engage Business,<br/>Legal, Risk & BCP"]

L --> M --> N
end

%% ==========================
%% Recovery
%% ==========================
subgraph P5["🔄 Phase 5 - Recovery"]
direction TB
O["🧹 Eradicate malware<br/>💻 Reimage laptop"]
P["🔐 Rotate credentials<br/>🛡️ Strengthen detections"]
Q["💾 Restore known-good data<br/>✅ CIO/CISO approval"]
R["✔️ Business Owner validates<br/>Service & Data"]

O --> P --> Q --> R
end

%% ==========================
%% Closure
%% ==========================
subgraph P6["📋 Phase 6 - Closure"]
direction TB
S["👀 72-hour SEV1 Monitoring"]
T["📄 Final Report<br/>📚 Lessons Learned<br/>📌 Corrective Actions"]

S --> T
end

%% Main Flow
D --> E
H --> I
K --> L
N --> O
R --> S

%% Colors
classDef detect fill:#E2F0D9,stroke:#548235,color:#375623;
classDef contain fill:#FFF2CC,stroke:#BF8F00,color:#7F6000;
classDef crisis fill:#F4CCCC,stroke:#C00000,color:#7F0000;
classDef investigate fill:#D9EAD3,stroke:#38761D,color:#274E13;
classDef recover fill:#D9EAF7,stroke:#2F75B5,color:#17365D;
classDef close fill:#EADCF8,stroke:#7030A0,color:#3F1D5A;

class A,B,C,D detect;
class E,F,G,H contain;
class I,J,K crisis;
class L,M,N investigate;
class O,P,Q,R recover;
class S,T close;
```
## Response Action (SOP Aligned)
What action should do when ransomware happend, ensure SoP is follow.
```mermaid
flowchart TD
    %% =========================
    %% 1. DETECTION AND TRIAGE
    %% =========================
    A["CrowdStrike EDR alert, QRadar offense,<br/>file-server alert, or employee report"]
    B["SOC L1 acknowledges alert<br/>Identify host, user, IP, time, and alert type"]
    C["SOC L1 validates and enriches<br/>EDR, SIEM, IPAM, asset, AD, firewall, file-server logs"]
    D{"Credible potential or<br/>confirmed incident?"}
    D0["Document false-positive reasoning<br/>Close alert without ITSM incident"]
    E["Open ITSM cybersecurity incident<br/>Attach evidence and reference playbooks"]
    F["Assign provisional SEV1<br/>Complete formal severity scoring"]
    G["Escalate to SOC L2 immediately<br/>Within 15 minutes of credible validation"]

    A --> B --> C --> D
    D -- "No" --> D0
    D -- "Yes" --> E --> F --> G

    %% =========================
    %% 2. ANALYSIS AND COMMAND
    %% =========================
    H["SOC L2 confirms ransomware<br/>C2, persistence, credential access, mass file changes"]
    I["Reconstruct attack timeline<br/>Telegram download to detection and containment"]
    J["Define endpoint, identity,<br/>data, and infrastructure scope"]
    K["SOC Manager confirms major incident<br/>SOC Lead or L3 supports investigation"]
    L["Incident Communicator creates WAR Room<br/>Within 30 minutes of severity confirmation"]
    M["Notify Cybersecurity Head, CISO, and CIO<br/>By phone within 15 minutes of SEV1 confirmation"]
    M1["Provide factual initial update<br/>Impact, actions, uncertainty, decisions, next update"]

    G --> H --> I --> J --> K
    K --> L
    K --> M --> M1

    %% =========================
    %% 3. EVIDENCE + CONTAINMENT
    %% =========================
    N["Rapid evidence assessment<br/>Preserve critical logs and artifacts where feasible"]
    O{"Active ransomware, exfiltration,<br/>or lateral movement?"}
    P["Contain immediately<br/>Evidence capture continues in parallel"]
    P0["Capture basic evidence first<br/>Then contain under approved playbook"]

    J --> N --> O
    O -- "Yes" --> P
    O -- "No or unclear" --> P0

    subgraph CT["Parallel Containment Workstreams"]
        direction LR
        Q1["Endpoint<br/>Isolate host in EDR<br/>Kill malicious process<br/>Block hash<br/>Hunt other endpoints"]
        Q2["Identity<br/>Disable or restrict account<br/>Revoke sessions and tokens<br/>Reset credentials<br/>Review privileges"]
        Q3["Network<br/>Block malicious IP and domain<br/>Preserve traffic logs<br/>Assess exfiltration<br/>Restrict segment if needed"]
        Q4["File Server<br/>Stop malicious sessions<br/>Protect unaffected shares<br/>Restrict writes if required<br/>Check backups and snapshots"]
    end

    P --> Q1
    P --> Q2
    P --> Q3
    P --> Q4
    P0 --> Q1
    P0 --> Q2
    P0 --> Q3
    P0 --> Q4

    Q1 --> R["SOC L2 updates scope and ITSM<br/>Record action, justification, approval, time, and result"]
    Q2 --> R
    Q3 --> R
    Q4 --> R

    %% =========================
    %% 4. SPECIALIST ACTIONS
    %% =========================
    S1["CTI and Threat Hunting<br/>Enrich IOCs, identify campaign,<br/>search enterprise-wide"]
    S2["Loan Business Owner<br/>Assess loan-operation impact,<br/>workarounds, priorities, and tolerance"]
    S3["Legal, Privacy, Risk, Compliance<br/>Assess customer-data exposure,<br/>notification and regulatory risk"]
    S4{"Large-scale ransomware,<br/>critical system, or outage<br/>beyond tolerance?"}
    S5["SOC informs BCP Officer<br/>BCP Committee decides activation"]
    S6["Continue incident response<br/>without full BCP activation"]

    R --> S1
    R --> S2
    R --> S3
    S2 --> S4
    S4 -- "Yes" --> S5
    S4 -- "No" --> S6

    %% =========================
    %% 5. COMMUNICATION LOOP
    %% =========================
    T["Incident Communicator issues updates<br/>Every 30 to 60 minutes"]
    T1["Interim report<br/>SEV1: 6 to 12 hours<br/>Off-hours emergency override: within 2 hours"]

    M1 --> T
    R --> T
    T --> T1

    %% =========================
    %% 6. ERADICATION
    %% =========================
    U{"Containment stable and<br/>scope sufficiently understood?"}
    U0["Continue containment, hunting,<br/>scoping, and executive updates"]
    V1["SOC L2 removes malicious artifacts<br/>and validates no persistence or C2"]
    V2["IT Support reimages Loan laptop<br/>Patch, harden, install EDR, enable logging"]
    V3["IAM rotates exposed credentials,<br/>tokens, and privileged access"]
    V4["SOC Engineering adds IOCs<br/>and improves SIEM and EDR detections"]
    W["Verify eradication<br/>No malicious process, traffic, persistence,<br/>or additional infected systems"]

    S1 --> U
    S2 --> U
    S3 --> U
    S5 --> U
    S6 --> U
    U -- "No" --> U0 --> R
    U -- "Yes" --> V1
    U -- "Yes" --> V2
    U -- "Yes" --> V3
    U -- "Yes" --> V4
    V1 --> W
    V2 --> W
    V3 --> W
    V4 --> W

    %% =========================
    %% 7. RECOVERY
    %% =========================
    X{"Recovery preconditions met?<br/>Root cause mitigated, clean backup,<br/>business ready, CIO and CISO approval"}
    X0["Do not restore<br/>Resolve gaps and obtain approval"]
    Y1["IT restores from known-good backup<br/>in a controlled manner"]
    Y2["SOC validates security controls<br/>and monitors reconnection in real time"]
    Y3["Loan Business Owner validates<br/>functionality, data integrity, and reconciliation"]
    Z["Controlled return to service"]
    ZA["Enhanced monitoring window<br/>SEV1: minimum 72 hours"]
    ZB{"Any malicious indicator<br/>or recurrence?"}

    W --> X
    X -- "No" --> X0 --> W
    X -- "Yes" --> Y1 --> Y2 --> Y3 --> Z --> ZA --> ZB
    ZB -- "Yes" --> P

    %% =========================
    %% 8. CLOSURE
    %% =========================
    ZC["Recovery declared stable<br/>Business validation and CIO/CISO approval"]
    ZD["Final incident report<br/>SEV1: within 5 business days"]
    ZE["Lessons learned and action tracker<br/>Owners, due dates, validation evidence"]
    ZF["Secure evidence and reports<br/>Update ITSM and SOC Knowledge Base"]
    ZG["Close incident only after<br/>all SOP closure criteria are met"]

    ZB -- "No" --> ZC --> ZD --> ZE --> ZF --> ZG

    %% =========================
    %% STYLING
    %% =========================
    classDef detect fill:#E2F0D9,stroke:#548235,color:#375623;
    classDef triage fill:#E8F1FB,stroke:#2F75B5,color:#17365D;
    classDef decision fill:#FFF2CC,stroke:#BF8F00,color:#7F6000;
    classDef contain fill:#FCE4D6,stroke:#C00000,color:#7F0000;
    classDef command fill:#E4DFEC,stroke:#7030A0,color:#3F1D5A;
    classDef recovery fill:#DDEBF7,stroke:#1F4E78,color:#17365D;
    classDef close fill:#E2EFDA,stroke:#548235,color:#375623;

    class A detect;
    class B,C,E,F,G,H,I,J triage;
    class D,O,S4,U,X,ZB decision;
    class D0,P0 triage;
    class P,Q1,Q2,Q3,Q4,R,U0 contain;
    class K,L,M,M1,T,T1 command;
    class N,S1,S2,S3,S5,S6,V1,V2,V3,V4,W triage;
    class X0,Y1,Y2,Y3,Z,ZA recovery;
    class ZC,ZD,ZE,ZF,ZG close;
```