| name | performing-ransomware-tabletop-exercise |
| description | Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat actors like LockBit and ALPHV/BlackCat with injects covering double extortion and backup destruction, then evaluates responses against NIST CSF and CISA guidelines. Use when planning or running a ransomware tabletop exercise or incident response readiness drill.
|
| domain | cybersecurity |
| subdomain | ransomware-defense |
| tags | ["ransomware","incident-response","tabletop-exercise","defense","preparedness"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"] |
| mitre_attack | ["T1078","T1190","T1059","T1486","T1490"] |
| mitre_f3 | {"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]} |
Performing Ransomware Tabletop Exercise
When to Use
- Testing organizational ransomware response procedures annually or after major infrastructure changes
- Validating decision-making processes for ransom payment, regulatory notification, and public disclosure
- Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident
- Meeting cyber insurance policy requirements for documented incident response testing
- Identifying gaps in recovery playbooks, communication plans, and backup procedures
Do not use as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.
Prerequisites
- Documented incident response plan (IRP) that participants should have read before the exercise
- Identified exercise participants from: executive leadership, IT/security, legal, communications/PR, HR, operations, and external counsel
- Facilitator who is independent from the IR team (to provide objective evaluation)
- Ransomware scenario designed with injects that escalate over multiple rounds
- Evaluation criteria aligned to NIST CSF Respond/Recover functions
- Conference room or virtual meeting for 2-4 hours with no interruptions
Workflow
Step 1: Design the Exercise Scenario
Build a realistic scenario based on current threat actor TTPs:
Scenario Structure:
Phase 1: Initial Detection (30 min)
- SOC receives alert for suspicious process execution on file server
- EDR detects Cobalt Strike beacon on 3 workstations
- Inject: External threat intel report links C2 IP to LockBit affiliate
Phase 2: Escalation (30 min)
- Ransomware executes on 40% of servers during overnight hours
- Ransom note demands $2M in Bitcoin with 72-hour deadline
- Inject: Attackers contact media claiming data theft of customer PII
Phase 3: Decision Points (45 min)
- Backup assessment reveals immutable copies are intact but primary backups encrypted
- Legal advises on breach notification timeline (72 hours GDPR, varies by US state)
- Inject: Threat actor publishes sample of stolen data on leak site
Phase 4: Recovery and Communication (45 min)
- Recovery time estimate: 5-7 days from immutable backups
- Insurance carrier engages negotiation firm
- Inject: Major customer threatens contract termination without update within 24 hours
Scenario Variables to Customize:
- Threat actor group and known TTPs
- Percentage of infrastructure encrypted
- Whether backups are intact, partially compromised, or fully destroyed
