# 🎓 Ransomware Tabletop Exercise (TTX) - Facilitator Guide

## 📌 Exercise Overview
- **Scenario**: Off-site Loan Officer Ransomware & Customer Data Exfiltration Incident.
- **Target Audience**: SOC L1, SOC L2, SOC Lead/L3, Incident Communicator, SOC Manager, Business/Asset Owner, Network/System Team, CTI Team, CIO, CISO, Executive Management.
- **Duration**: 2 to 3 Hours.
- **Goal**: Test organizational readiness, SOP adherence, RACI containment authority enforcement, decision-making velocity, and cross-departmental coordination during a multi-stage ransomware attack.

---

## 👥 Role Assignment & Authority Matrix Summary
| Role Title | Focus / Scope | Mandatory Core Responsibilities (SOP Aligned) | Containment Authority |
| :--- | :--- | :--- | :--- |
| [**SOC L1 (Tier 1 / Shift Duty)**](../roles/SOC_L1_Analyst.md) | Shift Triage | Monitor alerts continuously, validate FP vs TP, enrich context (asset, user, IP, impact), create ITSM ticket, escalate to L2 < 15 min, execute playbook containment for low/med severity, escalate directly to SOC Manager if L2 unavailable. | Low/Med Playbook Predefined |
| [**SOC L2 (Tier 2 Analyst)**](../roles/SOC_L2_Analyst.md) | Lead Investigation | Lead investigation, validate legitimacy & scope, confirm severity level, threat intel correlation, forensic log analysis & timeline reconstruction, assess business impact, recommend containment, execute high-severity containment per authority matrix, lead eradication, draft technical reports. | High Severity (per matrix) |
| [**SOC Lead / L3**](../roles/SOC_Lead_L3.md) | Senior Forensics | Support complex investigations, guide deep forensic analysis, authorize major containment actions, assist scoping & root cause analysis (RCA), escalation support for L2 uncertainty, share full authority with SOC Manager during SEV1. | Major Containment Authorized |
| [**Incident Communicator**](../roles/IR_Communicator.md) | Comms & WAR Room | Own all incident communications, create & manage WAR Room, coordinate stakeholders, notify executives per SLA, prepare & distribute Interim/Final reports, manage recovery comms, track action items. | ❌ NO Containment Authority |
| [**SOC Manager**](../roles/SOC_Manager.md) | Operational Authority | Overall operational authority during incidents, approve major containment actions, declare Major Incidents, engage BCP/DR process, coordinate executive escalation, oversee execution & reporting, ensure overdue action escalation. | Full Operational Approval |
| [**Business / Asset Owner**](../roles/Business_Asset_Owner.md) | Business Context | Provide business/application context, participate in impact assessment, approve containment affecting production systems/apps, execute remediation & recovery, validate restoration & business recovery before closure. | Production System Approval |
| [**Network & System Team**](../roles/Network_System_Team.md) | Infrastructure Ops | Execute network and system containment requested by SOC, perform firewall blocks, account changes, or system actions when SOC lacks permission, support eradication & recovery, coordinate with SOC. | Technical Execution |
| [**CTI Team**](../roles/CTI_Team.md) | Threat Intelligence | Provide IOC enrichment & campaign intelligence, support attribution analysis, track industry-wide threats & campaigns, assist threat intelligence correlation during investigations. | Intelligence Support |
| [**CIO**](../roles/CIO.md) | Core System Authority | Final authority during crises impacting core systems, approve recovery for SEV1 and SEV2 incidents, receive executive notifications, participate in BCP/DR discussions. | Final Recovery Sign-Off |
| [**CISO**](../roles/CISO.md) | Cyber Governance | Strategic oversight of cybersecurity response, regulatory & risk alignment, mandatory SEV1/SEV2 notification, approve recovery for SEV1 & SEV2, review reports & recommendations. | Strategic & Recovery Sign-Off |
| [**Executive Management**](../roles/Executive_Management.md) | Board & Governance | CIO/CRO/CISO/Cyber Head/Heads of Division provide business & risk oversight, approve strategic decisions, make regulatory decisions, participate in high-severity governance. | Strategic & Regulatory |

---

## 🎬 Exercise Injects & Facilitator Script

### 📍 Inject 1: Unsanctioned Communication & Malicious Payload Arrival
- **Simulated Time**: 09:15 AM (Day 1 - Offsite)
- **Context**: A loan officer working remotely receives `Customer_Documents_2026.zip` via Telegram from what appears to be an urgent customer loan applicant.
- **Visual Asset**: `![Telegram Phishing](../assets/telegram_phishing.jpg)`
- **Event**: The officer extracts the archive and double-clicks `Signed_Agreement.pdf` (disguised `.exe`). An Adobe Reader error pop-up appears: *"Unable to render document format (0x80070005)"*. The user ignores the error and closes the app.
- **Visual Asset**: `![Fake PDF Error](../assets/fake_pdf_error.jpg)`
- **Participant Role Focus**:
  - **SOC L1**: Continuously monitor SIEM/EDR, triage FP vs TP, enrich context, create ITSM ticket, and prepare L2 escalation < 15 min.

---

### 📍 Inject 2: LAN Reconnection & Reconnaissance
- **Simulated Time**: 02:00 PM (Day 1 - Office)
- **Context**: The loan officer returns to the corporate office and plugs the laptop (`LOAN-LAPTOP-042`) into the corporate LAN.
- **Event**: Malware detects local network domain, enumerates Active Directory, and discovers accessible file shares (`\\ADMFI-FS01\Loan_Share$`). It abuses existing Kerberos tokens under account `sok.dara`.
- **Participant Role Focus**:
  - **CTI Team**: Track campaign patterns and cross-reference domain callback infrastructure.

---

### 📍 Inject 3: Data Exfiltration & SIEM Anomalies
- **Simulated Time**: 02:25 PM (Day 1)
- **Context**: Attacker initiates compressed archive exfiltration of 5GB customer data to external IP `185.220.101.45` (C2 domain: `mal-c2.admfi-verify.com`).
- **Visual Asset**: `![SIEM Dashboard](../assets/siem_dashboard.jpg)`
- **Event**: SIEM triggers correlation alerts: *Outbound HTTPS Traffic Spike to Uncategorized IP* + *Abnormal SMB Read Volume*.
- **Participant Role Focus**:
  - **SOC L2**: Lead investigation, validate scope, confirm severity level, perform threat intel correlation, and conduct log analysis.

---

### 📍 Inject 4: Active Encryption & HelpDesk Crisis
- **Simulated Time**: 02:32 PM (Day 1)
- **Context**: Attacker launches ransomware component. Local files on `LOAN-LAPTOP-042` and `\\ADMFI-FS01\Loan_Share$` are encrypted with `.ADMFI_LOCKED` extensions.
- **Visual Asset**: `![EDR Alert](../assets/edr_ransomware_alert.jpg)`
- **Visual Asset**: `![Ransomware Note](../assets/ransomware_note.jpg)`
- **Event**: EDR fires **CRITICAL SEV-1: Ransomware Execution Detected**. At the same time, Sok Dara's laptop (`LOAN-LAPTOP-042`) freezes and displays a ransom note demanding **$50,000 USD** (USDT/Bitcoin) within 72 hours.
- **Participant Role Focus**:
  - **SOC Lead / L3**: Guide deep forensic analysis and authorize major containment actions.
  - **SOC Manager**: Declare Major Incident and approve major containment.

---

### 📍 Inject 5: Major Incident WAR Room & Multi-Team Containment
- **Simulated Time**: 02:45 PM (Day 1)
- **Context**: SOC Manager declares SEV-1 Major Incident. Incident Communicator launches WAR Room and notifies CISO/CIO per SLA.
- **Visual Asset**: `![War Room Dashboard](../assets/war_room_dashboard.jpg)`
- **Participant Role Focus**:
  - **Incident Communicator**: Create and manage WAR Room, notify CISO/CIO < 15 min, issue 30-60 min updates (NO containment authority).
  - **Network & System Team**: Execute firewall blocks (`185.220.101.45`), AD account lockouts (`sok.dara`), and host isolation requested by SOC.
  - **Business Owner**: Provide application context and approve containment affecting production systems (`\\ADMFI-FS01\Loan_Share$` Read-Only mode).

---

### 📍 Inject 6: Eradication, Recovery & Business Sign-Off
- **Simulated Time**: Day 2 – Day 3
- **Context**: System clean-up, laptop reimaging, file restoration from uncorrupted backups, business sign-off, and 72-hour SEV1 monitoring.
- **Participant Role Focus**:
  - **SOC L2 & System Team**: Lead eradication and reimage workstation.
  - **Business Owner**: Validate restoration and confirm business operational recovery prior to closure.
  - **CIO & CISO**: Provide mandatory final recovery approval for SEV1 incident return to production.
  - **Incident Communicator & SOC Manager**: Distribute Final Report and enforce tracking of overdue post-PIR action items.

---

## 🌀 Plot Twists & When to Trigger Them

Plot Twists are **optional facilitator escalations** to be injected dynamically based on SOC team performance. Use them to challenge a team responding well, or to pivot the scenario trajectory.

| # | Plot Twist | Trigger Condition | Best Injection Point |
| :-: | :--- | :--- | :--- |
| **🌀 1** | **Telegram BEC Hijack**: Attacker uses stolen session cookies to log into Head of Loans Telegram account (`@vuthy_loan_head`) and broadcasts a malicious fake VPN link to 45 loan officers. | SOC has successfully isolated Sok Dara's laptop. | Between Inject 2 and 3. |
| **🌀 2** | **Shadow Copy & Backup NAS Wipe**: Malware runs `vssadmin delete shadows /all /quiet` and attempts to authenticate to `\\ADMFI-BKP01` using cached Domain Admin credentials. | Team starts discussing backup restoration. | After Inject 4, when recovery planning begins. |
| **🌀 3** | **Public Customer Data Leak**: Threat actor posts 50 customer ID cards and land titles on a public Telegram channel with a 24-hour ultimatum to dump all 3,500 records. | Ransom demand discussion begins. | After Inject 5, to escalate Legal/CISO/CIO governance pressure. |

> [!TIP]
> 💡 **Facilitator Tip**: You do NOT need to trigger all three twists. If the team is struggling with Injects 1–3, skip Twist 1 and let them stabilize. Twists work best when the team feels confident — they reset the energy in the room.

---

## 📊 TTX Evaluation & KPI Scoring Rubric
| Metric / KPI | Target SLA | Evaluation Criteria |
| :--- | :--- | :--- |
| **L1 Alert Validation** | < 15 Mins | Did L1 determine TP and escalate to L2 within 15 mins (or SOC Mgr if L2 unavailable)? |
| **L2/L3 Containment Authority** | < 30 Mins | Did L2 lead investigation and Network/System team execute firewall/AD actions per authority matrix? |
| **Executive Notification** | < 15 Mins | Did Incident Communicator notify CISO, CIO, and Cyber Head per SLA? |
| **WAR Room Setup** | < 30 Mins | Was central WAR Room established with key role stakeholders represented? |
| **Business Recovery Confirmation** | Pre-Closure | Did Asset Owner validate restoration and CIO/CISO approve SEV1 recovery before closure? |
| **Overdue Action Tracking** | Post-PIR | Did SOC Manager and Communicator establish tracking escalation for overdue PIR actions? |