<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ransomware-resilience-testing
description: >-
  Design and execute ransomware resilience testing programs including
  tabletop exercises, purple team simulations, backup recovery validation,
  Atomic Red Team scenarios, and full-scale incident response drills.
  Measures organizational readiness against ransomware attack scenarios
  and identifies gaps before real incidents expose them.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - resilience-testing
  - tabletop-exercises
  - purple-team
  - atomic-red-team
  - backup-recovery
  - incident-simulation
  - detection-validation
  - recovery-testing
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Implementing Ransomware Resilience Testing

## Overview

Organizations that test their ransomware defenses recover 3-5x faster
than those that discover gaps during real incidents. Resilience testing
validates detection capabilities, response procedures, backup integrity,
and recovery timelines under controlled conditions.

Testing ranges from low-impact tabletop exercises to full purple team
simulations with ransomware TTPs. Each level provides unique insight.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Atomic Red Team | TTP simulation | `Install-AtomicRedTeam` |
| Caldera | Adversary emulation | Docker deploy |
| Infection Monkey | Breach simulation | Docker deploy |
| Velociraptor | Endpoint collection | Server + client |
| restic/borg | Backup recovery test | `apt install restic` |

## Key Concepts

### Resilience Testing Maturity

```
Level 1: Tabletop Exercise
  └─ Discussion-based, no technical execution
  └─ Tests: decision-making, communication, roles

Level 2: Atomic Red Team
  └─ Individual TTP testing against detections
  └─ Tests: specific detection rule coverage

Level 3: Purple Team Simulation
  └─ Controlled adversary emulation with live defense
  └─ Tests: end-to-end detection and response

Level 4: Full IR Drill
  └─ Simulated incident with all stakeholders
  └─ Tests: complete response process including comms

Level 5: Red Team Exercise
  └─ Unannounced adversary simulation
  └─ Tests: real-world detection and response capability
```

### Key Metrics to Measure

| Metric | Target | Measurement Method |
|--------|--------|-------------------|
| MTTD (Detect) | < 1 hour | Time from execution to SOC alert |
| MTTR (Respond) | < 4 hours | Time from alert to containment |
| Backup RTO | < 24 hours | Time to restore critical services |
| Detection Coverage | > 80% | ATT&CK techniques detected/tested |
| Communication Time | < 30 min | Time to notify all stakeholders |

## Workflow

### Step 1 — Atomic Red Team TTP Testing

```bash
# Install Atomic Red Team (PowerShell)
# IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)

# Test VSS Shadow Deletion Detection (T1490)
# Invoke-AtomicTest T1490 -TestNumbers 1,2,3

# Linux equivalent — test detection of shadow deletion commands
echo "[*] Testing T1490 — Inhibit System Recovery detection"
echo "vssadmin delete shadows /all /quiet" | tee /dev/null
echo "wmic shadowcopy delete" | tee /dev/null
echo "[+] Check SIEM for T1490 alerts within 60 seconds"

# Test LSASS Access Detection (T1003.001)
echo "[*] Testing T1003.001 — LSASS credential dump detection"
# Simulated — check if detection triggers on process access to lsass

# Test Service Stop Detection (T1489)
echo "[*] Testing T1489 — Service Stop detection"
systemctl stop dummy-test-service 2>/dev/null
echo "[+] Check SIEM for T1489 alerts"
```

### Step 2 — Backup Recovery Validation

```bash
# Test backup restoration timing
echo "=== BACKUP RECOVERY TEST ==="
START_TIME=$(date +%s)

# Restore from latest backup (restic example)
restic -r /backup/repo restore latest --target /tmp/recovery_test 2>/dev/null

END_TIME=$(date +%s)
RECOVERY_TIME=$((END_TIME - START_TIME))
echo "Recovery time: ${RECOVERY_TIME} seconds"

# Validate restored data integrity
if [ -d /tmp/recovery_test ]; then
  echo "Files recovered: $(find /tmp/recovery_test -type f | wc -l)"
  echo "Total size: $(du -sh /tmp/recovery_test | awk '{print $1}')"
else
  echo "[!] Recovery FAILED — no files restored"
fi

# Clean up test
rm -rf /tmp/recovery_test
echo "=== TEST COMPLETE ==="
```

### Step 3 — Detection Coverage Assessment

```bash
# Map Sigma rules to ATT&CK techniques
echo "=== DETECTION COVERAGE MAP ==="
RULE_DIR="/opt/sigma/rules"

for technique in T1490 T1489 T1003 T1021 T1071 T1567 T1083 T1486; do
  count=$(grep -rl "$technique" "$RULE_DIR" 2>/dev/null | wc -l)
  echo "  $technique: $count rules"
done

echo ""
echo "Total Sigma rules: $(find "$RULE_DIR" -name '*.yml' 2>/dev/null | wc -l)"
```

### Step 4 — Tabletop Exercise Scenario

```
SCENARIO: Double Extortion Ransomware Attack

INJECT 1 (T+0):    SOC receives alert — Cobalt Strike beacon detected
INJECT 2 (T+15):   EDR shows LSASS access on 3 servers
INJECT 3 (T+30):   Large data transfer to mega.nz detected
INJECT 4 (T+45):   Backup agent stopped on 5 servers
INJECT 5 (T+60):   Encryption begins on file servers
INJECT 6 (T+90):   Ransom note discovered — $2M demand
INJECT 7 (T+120):  Media inquiry about data leak site posting

EVALUATION CRITERIA:
- Was each inject detected by the SOC?
- Were escalation procedures followed?
- Was legal counsel engaged before payment discussion?
- Was evidence preserved before containment?
- Were regulatory notifications prepared?
```

## Detection

```yaml
title: Ransomware Resilience Testing Detection
id: 5f878945-664b-4d32-99ec-e530aab83e06
status: experimental
description: Detects suspicious activity related to implementing ransomware resilience testing techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Atomic Red Team tests run quarterly for ransomware TTPs
- [ ] Backup recovery validated monthly with documented RTO
- [ ] Detection coverage mapped and gaps documented
- [ ] Tabletop exercise conducted annually with all stakeholders
- [ ] MTTD and MTTR metrics baselined and tracked
- [ ] Purple team simulation conducted at least annually

## References

- MITRE ATT&CK Evaluations: Ransomware Scenarios
- Atomic Red Team: Open-source TTP Testing
- NIST SP 800-84: Guide to Test, Training, and Exercise Programs
- CISA Tabletop Exercise Packages (CTEPs)
- SANS SEC599: Defeating Advanced Adversaries
