<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ransomware-tabletop-exercises
description: >-
  Design and facilitate ransomware tabletop exercises (TTX) that test
  organizational readiness, decision-making, and response procedures.
  Covers scenario development, inject design, participant roles, exercise
  facilitation, after-action reporting, and gap remediation tracking.
  Includes ready-to-use scenarios for double extortion, supply chain
  ransomware, and critical infrastructure attacks.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - tabletop-exercise
  - incident-response
  - crisis-management
  - ransomware-readiness
  - business-continuity
  - executive-briefing
  - gap-analysis
  - after-action-report
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Performing Ransomware Tabletop Exercises

## Overview

Tabletop exercises (TTX) test ransomware response capabilities without
operational disruption. A well-designed TTX reveals gaps in communication,
decision-making, technical response, and business continuity that only
surface under pressure. Run quarterly — ransomware groups don't wait.

Key principle: the goal is to find gaps, not to pass. A TTX that
reveals no weaknesses was poorly designed.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Scenario templates | Pre-built exercise scenarios | This skill |
| Timer | Inject pacing | Any timer app |
| Note-taking | Observer documentation | Shared doc |
| Video conference | Remote participants | Zoom/Teams |
| After-action template | Gap documentation | This skill |

## Key Concepts

### Exercise Structure

```
Phase 1: Setup (15 min)
├── Ground rules and objectives
├── Scenario introduction
└── Role assignments

Phase 2: Scenario Injects (90-120 min)
├── Inject 1: Initial detection (T+0)
├── Inject 2: Scope escalation (T+1h)
├── Inject 3: Executive pressure (T+4h)
├── Inject 4: External complications (T+8h)
├── Inject 5: Recovery decisions (T+24h)
└── Inject 6: Post-incident (T+72h)

Phase 3: Hot Wash (30 min)
├── Immediate observations
├── What worked well
└── Critical gaps identified

Phase 4: After-Action Report (1-2 weeks post)
├── Findings and recommendations
├── Gap remediation plan
└── Follow-up exercise date
```

### Participant Roles

| Role | Participants | Focus Area |
|------|-------------|-----------|
| Exercise Lead | Security manager | Facilitation, inject delivery |
| CISO/Security Dir | Security leadership | Strategic decisions |
| IT Operations | Sysadmin, network | Technical response |
| Legal Counsel | General counsel | Regulatory, liability |
| Communications | PR/Comms team | Stakeholder messaging |
| Executive | C-suite representative | Business decisions |
| Observer | Notetaker(s) | Document gaps and decisions |
| Simulated Threat | Optional red team | Realistic pressure |

## Workflow

### Step 1 — Scenario: Double Extortion Attack

```
SCENARIO: "Operation Midnight Lock"

Background:
Your organization (5,000 employees, $2B revenue) is a healthcare
services provider. At 2:47 AM Saturday, your SOC receives alerts
from CrowdStrike Falcon indicating ransomware activity on multiple
servers in the data center.

INJECT 1 — Detection (T+0, Saturday 2:47 AM)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOC Alert: CrowdStrike detects "LockBit 3.0" ransomware executing
on 15 servers. Volume Shadow Copy deletion detected on 8 systems.
EDR has contained 10 of 15 servers. 5 servers unreachable.

Discussion questions:
- Who gets called first? What's the notification chain?
- Do we have an after-hours contact list? Is it current?
- What's our first containment action?

INJECT 2 — Scope Escalation (T+1 hour)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Update: Encryption confirmed on 42 servers including:
- 2 of 3 domain controllers
- Primary file server (3TB patient records)
- Backup management server (Veeam console)
- Email server (Exchange)
Ransom note demands $5M in Bitcoin. 72-hour deadline.

Discussion questions:
- Are our backups intact? Can we verify?
- Who decides whether to engage with the threat actor?
- Do we notify law enforcement now or wait?

INJECT 3 — Data Exfiltration Confirmed (T+4 hours)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Update: Threat actor's leak site shows your company listed.
Sample data published: 50 patient records with SSN, diagnosis,
and insurance information. Threat actor claims 500GB exfiltrated.

Discussion questions:
- HIPAA breach notification triggered? (threshold: 500+ records)
- Do we notify patients? When? How?
- Media is calling. What's our statement?
- Does insurance cover this? Who's our breach coach?

INJECT 4 — Recovery Complications (T+8 hours)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Update: Backup verification reveals:
- Offsite S3 backups intact (24h old)
- On-prem Veeam backups encrypted (compromised)
- DC backup exists but is 72 hours old
Estimated recovery time: 5-7 days for full restoration.
Hospital operations running on paper. ER diverting patients.

Discussion questions:
- Can we operate on paper for 5-7 days?
- What's the patient safety impact?
- Do we engage a ransomware negotiation firm?

INJECT 5 — Decision Point (T+24 hours)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Update: Negotiation firm has made contact. Threat actor offers:
- Decryption key for $2.5M (reduced from $5M)
- Data deletion guarantee (unverifiable)
- 48 hours remaining on deadline

Recovery team estimates 4 more days to restore from S3 backups.
OFAC screening: threat actor group NOT on sanctions list.

Discussion questions:
- Pay or continue with backup recovery?
- Who makes the final decision?
- What does insurance/legal advise?
- Can we verify data deletion claims?

INJECT 6 — Post-Incident (T+72 hours)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Resolution: Organization restored from S3 backups in 6 days.
Patient records recovered to T-24h. 24 hours of data lost.
HHS notification filed. State AG notification in progress.
Media coverage ongoing. Board requesting briefing.

Discussion questions:
- What's our after-action timeline?
- What gaps did we find?
- What investments do we need?
- When do we exercise again?
```

### Step 2 — Observer Checklist

```
During the exercise, observers document:

COMMUNICATION
□ Was notification chain followed?
□ Were all stakeholders contacted timely?
□ Was there a clear incident commander?
□ Were external parties (legal, insurance, LE) engaged?

TECHNICAL RESPONSE
□ Was containment initiated within 15 minutes?
□ Were backups verified before restore?
□ Was evidence preserved before remediation?
□ Was initial access vector identified?

DECISION MAKING
□ Was there a clear decision authority?
□ Were decisions documented with rationale?
□ Were regulatory requirements considered?
□ Was patient/customer safety prioritized?

BUSINESS CONTINUITY
□ Were BCP procedures activated?
□ Were manual operations feasible?
□ Was recovery timeline communicated to stakeholders?
□ Were third-party dependencies identified?
```

### Step 3 — After-Action Report Template

```markdown
# Ransomware TTX After-Action Report

## Exercise Details
- Date: [exercise date]
- Scenario: [scenario name]
- Duration: [hours]
- Participants: [count and roles]

## Executive Summary
[2-3 sentence summary of key findings]

## Findings

### Finding 1: [Title]
- Gap: [description of gap identified]
- Impact: [business impact if gap not addressed]
- Recommendation: [specific remediation action]
- Owner: [responsible person/team]
- Target Date: [remediation deadline]
- Priority: [Critical/High/Medium/Low]

### Finding 2: [Title]
[repeat format]

## Strengths Observed
- [what worked well]

## Metrics
- Time to first notification: [minutes]
- Time to containment decision: [minutes]
- Backup verification status: [pass/fail]
- Decision authority clarity: [clear/unclear]

## Remediation Tracking
| # | Finding | Owner | Target | Status |
|---|---------|-------|--------|--------|
| 1 | [gap] | [who] | [when] | Open |

## Next Exercise
- Date: [target date — quarterly recommended]
- Scenario focus: [based on gaps found]
```

### Step 4 — Alternative Scenarios

```
SCENARIO B: "Supply Chain Compromise"
A software update from a critical vendor deploys ransomware.
Focus: vendor management, third-party risk, mass deployment.

SCENARIO C: "Insider Threat + Ransomware"
Disgruntled employee with admin access deploys ransomware.
Focus: insider threat detection, access control gaps.

SCENARIO D: "Cloud Infrastructure Attack"
Ransomware encrypts cloud-hosted workloads via compromised
cloud admin credentials.
Focus: cloud security, IAM, cloud backup recovery.
```

## Detection

```yaml
title: Ransomware Tabletop Exercises Detection
id: 027b3d0e-d820-4999-81ea-2ba62fe47836
status: experimental
description: Detects suspicious activity related to performing ransomware tabletop exercises techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Tabletop exercise conducted with cross-functional participants
- [ ] All 6 inject phases completed with documented decisions
- [ ] Observer notes capture communication, technical, and decision gaps
- [ ] After-action report produced within 2 weeks
- [ ] Gap remediation plan with owners and deadlines
- [ ] Follow-up exercise scheduled (quarterly cadence)
- [ ] Executive briefing on findings delivered

## References

- CISA Tabletop Exercise Package (CTEP): https://cisa.gov/cisa-tabletop-exercises-packages
- NIST SP 800-84: Guide to Test, Training, and Exercise Programs
- FEMA Homeland Security Exercise and Evaluation Program (HSEEP)
- HIPAA Breach Notification Rule: 45 CFR §§ 164.400-414
