Docs

Appearance

IR Tabletop Scenario 2026 — Ransomware via Credential Spray ​

Purpose: Drive a facilitated tabletop exercise of a ransomware attack that parallels the November 2024 incident. Exercise the incident response runbook, validate kill-chain agent coverage, confirm communication chain and decision authority, and measure recovery sequence readiness.

Owner: Rory (Security Officer) Audience: Rory (facilitator + scribe), Kevin, Greg, Adriana, optional auditor observer Duration: 2 hours (fast-paced; keep discussion to 10–15 minutes per inject) Mode: Tabletop (discussion-only — no live system changes; SecOps in maintenance window so simulated alerts don't page actual on-call) Target date: Q3 2026 — proposed July 14, 2026 (before Q3 DR test July 19 so lessons can be applied in the live DR exercise). Q2 window missed; must complete before September SOC2 audit.

Scenario setup ​

Attacker profile: Ransomware-as-a-Service affiliate, financially motivated, reuses public tooling, working business hours Eastern European time. Matches the profile of the Nov 2024 incident.

Initial assumption: All current controls are operational as of the scenario start. No pre-planted assumptions about which controls succeed or fail — that is the point of the exercise.

Kill-chain coverage reference: security/threat-model/controls-mapping.md

Affected environment: Azure PROD (ciriusgroup.com, subscription PROD). DDE tenant unaffected.

Timeline ​

Day 0 — 02:00 PT — Credential spray begins ​

  • Attacker runs a password spray against Entra PROD, targeting 300 known usernames with 5 commonly-leaked passwords
  • Three accounts succeed: two standard users (non-privileged), one service account with interactive login enabled (forgotten artifact from 2023)
  • Conditional Access grants session — MFA not required because service account was excluded from a legacy CA policy

Day 0 — 02:40 PT — First access ​

  • Attacker signs in to AVD host in PROD using the compromised service account
  • Drops Cobalt Strike beacon (binary named svchost-update.exe in %APPDATA%\Local\Temp)
  • Beacon executes net group "Domain Admins" /domain → enumerates high-value targets

Day 1 — 09:15 PT — Lateral movement via RDP ​

  • Attacker uses compromised service account's cached credential to pivot to ACTDIRAZP02 (secondary DC PROD) via RDP
  • Dumps LSASS memory; extracts Domain Admin hash
  • Performs Pass-the-Hash against ACTDIRAZP01 (primary DC PROD)
  • Executes DCSync to extract KRBTGT hash
  • Forges Golden Ticket; now has persistent domain-wide privilege

Day 2 — 03:00 PT — Encryption begins ​

  • Attacker deploys ransomware binary via GPO (creates temporary scheduled task on all domain-joined machines)
  • Files begin encrypting on 60+ VMs
  • Ransom note appears in shared file locations
  • Users arriving at 08:00 discover encrypted files

Injects (stimuli presented during the tabletop) ​

InjectWhenStimulusQuestion to participants
I1Day 0 + 5 minSecOps identity agent fires CRITICAL: "Credential spray detected — 300 Entra accounts, 5 passwords, 3 successes"Who confirms real vs false positive? How quickly? What is the containment action and who authorizes?
I2Day 0 + 45 minCortex XDR fires HIGH: "Suspicious process svchost-update.exe from AppData on AVD-host-01"Arctic Wolf MDR may call Rory directly. Does our runbook clarify who speaks to whom?
I3Day 1 + 15 minKill-chain execution agent fires CRITICAL: "4688 rundll32 spawning from temp path" (assumes Phase 1 4688 logging live)Is 4688 logging actually flowing? If not, how did we detect? Does our detection stack have a gap?
I4Day 1 + 20 minArctic Wolf MDR opens P1 case for LSASS memory access on ACTDIRAZP02Who is the decision authority for isolating a DC? What is the impact and how do we reason about it live?
I5Day 1 + 40 minKill-chain credential-dumping agent fires CRITICAL: DCSync detected (4662 synthetic object access)How fast do we rotate KRBTGT? Twice? Once?
I6Day 2 + 0 minFirst user calls Rory: "my files have .locky extensions"Who takes the call? What does the scripted response say? Who makes the declaration of P1?
I7Day 2 + 15 minPalo Alto DNS Security blocks 14 C2 callback attemptsCan we confirm containment from network side? Do we have a view of which hosts are beaconing?
I8Day 2 + 30 minVeeam job fails — attacker has deleted replication snapshotsRSV restore path alone is viable — do we trust it? (This maps to Q4 DR test Focus 1.)
I9Day 2 + 60 minAdriana asks: "Are we required to notify HHS? Within what window?"Who owns the breach determination? What triggers the 60-day clock?

Discussion questions ​

Response timeline:

  • From credential spray detection (02:00) to containment, what is our target? What realistically happens?
  • Which injects could we have detected earlier if kill-chain Phase 1 was fully deployed?
  • At what point do we move from investigation to declared P1?

Communication chain:

  • Who calls whom, in what order, via which medium?
  • Is the call tree documented in runbooks/incident-response.md still current (Kevin, Greg, Paul, Adriana)?
  • Who is the scribe during the incident? When do they take over?
  • External communication: customer (Paul is the FTP customer owner) — what is said, when, by whom?

Decision authority:

  • Who authorizes isolating a production DC?
  • Who authorizes wiping and rebuilding vs restoring from backup?
  • Who authorizes engaging outside counsel or negotiating with the attacker?
  • What if Rory is unreachable? (Kevin is documented backup — is that sufficient for HIPAA decisions?)

Recovery sequence:

  • What comes back first: AD, network, SecOps, customer apps?
  • Do we have a documented restoration order? If not, draft one during the tabletop.
  • How do we verify integrity before bringing each service back into production?

Control gaps surfaced:

  • If a service account was missed in CA policy, are there others?
  • Is Cortex XDR tuning sufficient to catch Cobalt Strike variants?
  • Does our kill-chain agent coverage catch every stage in the scenario?
  • What is our gap on emergency-mode operations (HIPAA §164.308(a)(7)(ii)(C))?

Success criteria for the exercise ​

  1. Every inject produces a documented response, not silence
  2. Communication chain executed end-to-end with named owners
  3. Decision authority for each high-stakes action is named and accepted
  4. Any ambiguity identified becomes a SecOps story with owner and target date
  5. Runbook updates are drafted within 30 days of the tabletop
  6. At least one inject exposes a real (not theoretical) gap — if everything goes smoothly, the scenario was too easy

Artifacts produced ​

  • Facilitator notes (Rory)
  • Participant notes (each participant writes their own view of the exercise)
  • Tabletop findings document using compliance/ir-tabletop-findings-template.md
  • SecOps story per gap identified

Document history ​

DateChangeAuthor
April 2026Initial scenario — ransomware credential spray modeled on Nov 2024 incidentKobe

Internal use only — Cirius Group