performing-ransomware-tabletop-exercise skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. 'Plans and facilitates tabletop exercises simulating ransomware incidents, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/performing-ransomware-tabletop-exercise/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-ransomware-tabletop-exercise, or copy the skill folder into ~/.claude/skills/performing-ransomware-tabletop-exercise/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-tabletop-exercise/SKILL.md

SKILL.md (verbatim)

name: performing-ransomware-tabletop-exercise
description: 'Plans and facilitates tabletop exercises simulating ransomware incidents,
  using realistic scenarios based on threat actors like LockBit and ALPHV/BlackCat
  with injects covering double extortion and backup destruction, then evaluates responses
  against NIST CSF and CISA guidelines. Use when planning or running a ransomware
  tabletop exercise or incident response readiness drill.

  '
domain: cybersecurity
subdomain: ransomware-defense
tags:
- ransomware
- incident-response
- tabletop-exercise
- defense
- preparedness
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-11
- RS.MA-01
- RC.RP-01
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1059
- T1486
- T1490
mitre_f3:
  version: '1.1'
  tactics:
  - positioning
  - monetization
  techniques:
  - id: T1531
    name: Account Access Removal
    tactic: positioning
    source: attack
  - id: F1018
    name: Convert to Cryptocurrency
    tactic: monetization
    source: f3
  - id: F1047
    name: Transfer of funds
    tactic: monetization
    source: f3
  - id: F1017.001
    name: 'Conversion to Physical Monetary Instruments: Cash'
    tactic: monetization
    source: f3

Performing Ransomware Tabletop Exercise

When to Use

  • Testing organizational ransomware response procedures annually or after major infrastructure changes
  • Validating decision-making processes for ransom payment, regulatory notification, and public disclosure
  • Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident
  • Meeting cyber insurance policy requirements for documented incident response testing
  • Identifying gaps in recovery playbooks, communication plans, and backup procedures

Do not use as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.

Prerequisites

  • Documented incident response plan (IRP) that participants should have read before the exercise
  • Identified exercise participants from: executive leadership, IT/security, legal, communications/PR, HR, operations, and external counsel
  • Facilitator who is independent from the IR team (to provide objective evaluation)
  • Ransomware scenario designed with injects that escalate over multiple rounds
  • Evaluation criteria aligned to NIST CSF Respond/Recover functions
  • Conference room or virtual meeting for 2-4 hours with no interruptions

Workflow

Step 1: Design the Exercise Scenario

Build a realistic scenario based on current threat actor TTPs:

Scenario Structure:

Phase 1: Initial Detection (30 min)
  - SOC receives alert for suspicious process execution on file server
  - EDR detects Cobalt Strike beacon on 3 workstations
  - Inject: External threat intel report links C2 IP to LockBit affiliate

Phase 2: Escalation (30 min)
  - Ransomware executes on 40% of servers during overnight hours
  - Ransom note demands $2M in Bitcoin with 72-hour deadline
  - Inject: Attackers contact media claiming data theft of customer PII

Phase 3: Decision Points (45 min)
  - Backup assessment reveals immutable copies are intact but primary backups encrypted
  - Legal advises on breach notification timeline (72 hours GDPR, varies by US state)
  - Inject: Threat actor publishes sample of stolen data on leak site

Phase 4: Recovery and Communication (45 min)
  - Recovery time estimate: 5-7 days from immutable backups
  - Insurance carrier engages negotiation firm
  - Inject: Major customer threatens contract termination without update within 24 hours

Scenario Variables to Customize:

  • Threat actor group and known TTPs
  • Percentage of infrastructure encrypted
  • Whether backups are intact, partially compromised, or fully destroyed
  • Type of data exfiltrated (PII, PHI, financial, trade secrets)
  • Applicable regulatory frameworks (GDPR, HIPAA, PCI DSS, SEC rules)
  • Ransom amount and payment deadline

Step 2: Prepare Exercise Materials

Create the following documents for participants:

  1. Exercise Overview Briefing - Ground rules, objectives, scope, and participants
  2. Situation Reports (SITREPs) - One per phase, distributed as the exercise progresses
  3. Inject Cards - New information introduced at specific times to force decision-making
  4. Decision Point Worksheets - Structured forms for documenting group decisions
  5. Evaluation Scorecard - Criteria for assessing response quality

Key Decision Points to Include:

  • When to activate the incident response team
  • Whether to shut down systems or contain selectively
  • Whether to engage law enforcement (FBI IC3, CISA)
  • Whether to pay the ransom and under what conditions
  • When and how to notify regulators, customers, and the public
  • How to prioritize system recovery order

Step 3: Facilitate the Exercise

Facilitator Responsibilities:

  • Present each phase scenario and distribute SITREPs
  • Introduce injects at predetermined times to increase pressure
  • Ask probing questions to test decision-making reasoning
  • Ensure all participant groups contribute (prevent IT from dominating)
  • Document all decisions, rationales, and action items
  • Track time management (many teams lose time on early phases)

Probing Questions by Phase:

Phase 1 - Detection:

  • Who makes the call to declare an incident? What criteria trigger it?
  • How do we determine the scope of compromise from initial alerts?
  • Do we have the forensic capability to investigate or do we need external help?

Phase 2 - Escalation:

  • What is our communication plan for employees? Do they know not to turn on affected machines?
  • Have we isolated the network to prevent further encryption?
  • Who authorizes system shutdowns that impact business operations?

Phase 3 - Decision:

  • Under what conditions would we consider paying the ransom?
  • What are the legal obligations for notification at this point?
  • How do we handle the public leak of customer data?

Phase 4 - Recovery:

  • What is the recovery priority order? Is it documented or decided ad hoc?
  • How long until critical business operations resume?
  • What evidence preservation is required for law enforcement and insurance?

Step 4: Evaluate and Score Responses

Score each functional area against defined criteria:

Evaluation Area Score (1-5) Criteria
Detection & Escalation Timely incident declaration, proper chain of command
Containment Network isolation, credential reset, scope assessment
Communication - Internal Employee notification, executive briefing, documented decisions
Communication - External Regulatory notification, customer communication, media response
Recovery Planning Backup verification, recovery priority, RTO tracking
Legal & Compliance Breach notification timelines, evidence preservation, law enforcement engagement
Business Continuity Manual operations, customer impact mitigation, revenue loss estimation
Payment Decision Structured framework, legal review, OFAC sanctions check

Step 5: Document Findings and Remediation Plan

Produce an after-action report (AAR) within 5 business days:

AAR Contents:

  1. Exercise overview and objectives
  2. Scenario summary and injects
  3. Key decisions made and rationale
  4. Strengths observed
  5. Gaps identified with severity rating
  6. Remediation actions with owners and deadlines
  7. Comparison to previous exercise results (if applicable)

Key Concepts

Term Definition
Tabletop Exercise (TTX) Discussion-based exercise where participants walk through a simulated incident scenario to test plans and procedures
Inject New information introduced during the exercise to change the scenario and force additional decision-making
SITREP Situation Report providing current status of the simulated incident at each exercise phase
After-Action Report (AAR) Post-exercise document capturing findings, gaps, strengths, and remediation actions
Double Extortion Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless ransom is paid
OFAC Check Verification that ransom payment recipient is not on the US Treasury OFAC sanctions list, which would make payment illegal

Tools & Systems

  • CISA Tabletop Exercise Packages (CTEPs): Free scenario packages from CISA designed for critical infrastructure sectors
  • FEMA Homeland Security Exercise and Evaluation Program (HSEEP): Methodology for designing, conducting, and evaluating exercises
  • Immersive Labs: Platform providing interactive cyber crisis simulations with real-time scoring
  • Tabletop Scenarios (from NCSC UK): Exercise in a Box tool providing free guided tabletop exercises
  • Ransomware Readiness Assessment (CISA): Self-assessment tool for evaluating ransomware preparedness

Common Scenarios

Scenario: Healthcare System Double Extortion Exercise

Context: A 5-hospital healthcare system conducts an annual ransomware tabletop. Previous exercise revealed gaps in HIPAA breach notification and clinical system recovery priority. This year's scenario simulates a double extortion attack targeting the EMR system.

Approach:

  1. Design scenario based on Cl0p MOO (Managed Operations Operator) TTPs: exploitation of MOVEit vulnerability for initial access, data exfiltration of 500,000 patient records, followed by encryption of EMR database servers
  2. Participants: CISO, CIO, CMO (Chief Medical Officer), General Counsel, VP Communications, Director of Clinical Operations, Privacy Officer, External IR firm representative
  3. Phase 1 inject: EMR system down, emergency department diverting patients to neighboring hospital
  4. Phase 2 inject: HHS OCR (Office for Civil Rights) contacts organization about reports of patient data on dark web
  5. Phase 3 inject: Attacker provides decryption key sample for $3.5M, 48-hour deadline
  6. Key finding: Organization lacks documented criteria for ransom payment decision and had not pre-identified an OFAC-compliant payment mechanism
  7. Remediation: Establish payment decision framework, pre-engage ransomware negotiation firm, update HIPAA breach notification procedures with specific timelines

Pitfalls:

  • Designing unrealistic scenarios that do not reflect actual ransomware TTPs, reducing exercise credibility
  • Allowing technical teams to dominate the exercise while business and legal participants remain passive
  • Not testing the communication plan (many organizations discover their notification list is outdated during the actual incident)
  • Failing to follow up on remediation actions identified in the AAR, negating the exercise value

Output Format

## Ransomware Tabletop Exercise - After Action Report

**Exercise Date**: [Date]
**Facilitator**: [Name]
**Scenario**: [Brief description]
**Duration**: [Hours]
**Participants**: [Count by department]

### Exercise Objectives
1. [Objective] - Met / Partially Met / Not Met
2. [Objective] - Met / Partially Met / Not Met

### Key Decisions Log
| Time | Decision Point | Decision Made | Rationale | Assessment |
|------|---------------|--------------|-----------|------------|

### Strengths Observed
1. [Strength]

### Gaps Identified
| Gap | Severity | Affected Area | Current State | Desired State |
|-----|----------|--------------|---------------|---------------|

### Remediation Actions
| Action | Owner | Deadline | Priority | Status |
|--------|-------|----------|----------|--------|

### Comparison to Previous Exercise
| Area | Previous Score | Current Score | Trend |
|------|---------------|--------------|-------|

Other files in this skill

assets/template.md (verbatim)

Ransomware Tabletop Exercise Template

Exercise Overview

Field Value
Exercise Name
Date
Duration 3-4 hours
Facilitator
Scenario [Threat Actor] ransomware attack
Industry

Participants

Name Role Department Present (Y/N)
CISO Security
CIO IT
General Counsel Legal
VP Comms PR
COO Operations
CFO Finance

Phase 1: Detection SITREP

[Insert scenario text]

Discussion Questions

  1. Who declares the incident?
  2. What is the immediate containment action?
  3. Who is notified at this stage?

Decisions Made

Decision Rationale Owner

Phase 2: Escalation SITREP

[Insert scenario text]

Discussion Questions

  1. What is the scope assessment process?
  2. How do we maintain business operations?
  3. Do we engage law enforcement?

Decisions Made

Decision Rationale Owner

Phase 3: Critical Decisions SITREP

[Insert scenario text]

Discussion Questions

  1. Under what conditions do we pay?
  2. What are notification obligations?
  3. How do we respond to data leak?

Decisions Made

Decision Rationale Owner

Phase 4: Recovery SITREP

[Insert scenario text]

Discussion Questions

  1. What is recovery priority order?
  2. What do we tell customers?
  3. What is the media statement?

Decisions Made

Decision Rationale Owner

Evaluation Scorecard

Area Score (1-5) Notes
Detection & Escalation
Containment
Internal Communication
External Communication
Recovery Planning
Legal & Compliance
Business Continuity
Payment Decision
Overall

Key Findings

Strengths

Gaps

Gap Severity Owner Remediation Deadline
Critical/High/Medium

Sign-Off

Role Name Signature Date
Exercise Sponsor
Facilitator

references/api-reference.md (verbatim)

Ransomware Tabletop Exercise - API Reference

Scenario Framework

Phase Structure

Each phase contains:

Field Type Description
phase string Phase name: detection, containment, escalation, eradication, recovery
inject string Narrative scenario inject read to participants
expected_actions list Correct response actions for scoring
time_pressure_minutes int Simulated time window for decisions

Exercise Variants

  • standard - Normal time pressure, full scenario
  • accelerated - Half time windows, tests rapid decision-making

Scoring Algorithm

phase_score = (correct_actions / expected_actions) * 100
overall_score = mean(all_phase_scores)

Rating thresholds:

  • = 90%: Excellent

  • = 70%: Good

  • = 50%: Needs Improvement

  • < 50%: Critical Gaps

Expected Actions by Phase

Detection

  • isolate_host - Quarantine affected endpoint
  • preserve_evidence - Capture memory dump and disk image
  • notify_ir_lead - Escalate to incident response lead

Containment

  • network_segmentation - Restrict lateral movement paths
  • disable_compromised_accounts - Lock affected credentials
  • block_c2_domains - Update firewall/proxy deny lists
  • preserve_shadow_copies - Protect backup snapshots

Escalation

  • notify_executive_team - Brief C-suite leadership
  • engage_legal_counsel - Activate legal response team
  • contact_law_enforcement - Report to FBI IC3 or local CIRT
  • activate_crisis_comms - Prepare stakeholder communications

Eradication

  • remove_persistence - Clean scheduled tasks, registry keys, WMI subscriptions
  • reset_all_credentials - Reset passwords domain-wide
  • rebuild_compromised_hosts - Reimage from gold images
  • reset_krbtgt_twice - Invalidate all Kerberos tickets

Recovery

  • restore_from_backup - Use verified clean backup sets
  • validate_restored_systems - Run integrity checks
  • monitor_for_reinfection - Enhanced monitoring for 72+ hours
  • staged_network_reconnection - Reconnect systems in phases

After-Action Report Schema

{
  "report": "ransomware_tabletop_aar",
  "evaluation": {
    "overall_score_pct": 78.5,
    "rating": "good",
    "phase_scores": [{"phase": "detection", "score_pct": 66.7}]
  },
  "recommendations": [{"phase": "detection", "gap": "Missed: preserve_evidence"}]
}

CLI Usage

python agent.py --mode demo --output aar.json
python agent.py --mode generate --variant accelerated --output scenario.json
python agent.py --mode score --responses-file responses.json --output aar.json

references/standards.md (verbatim)

Standards & References - Ransomware Tabletop Exercise

Exercise Standards

FEMA HSEEP (Homeland Security Exercise and Evaluation Program)

NIST SP 800-84: Guide to Test, Training, and Exercise Programs

  • Framework for developing IT plan test and exercise programs
  • Section 4.3: Tabletop exercises for incident response testing
  • Covers exercise scoping, objectives, scenario development, and evaluation

CISA Tabletop Exercise Packages (CTEPs)

Ransomware-Specific Guidance

CISA #StopRansomware Guide

  • Ransomware response checklist that exercises should validate
  • Decision tree for ransom payment considerations
  • Recovery priority guidance

NIST IR 8374: Ransomware Risk Management

  • Identifies exercise testing as a key control in the Recover function
  • Recommends annual tabletop exercises with escalating complexity

FBI/CISA Joint Advisories

  • AA24-131A: Black Basta Ransomware
  • AA23-136A: BianLian Ransomware Group
  • AA23-158A: CL0P Ransomware Gang Exploiting MOVEit
  • Use these as source material for realistic exercise scenarios

Regulatory Notification Requirements (for Scenario Design)

Regulation Notification Timeline Authority
GDPR (EU) 72 hours Supervisory Authority
HIPAA (US Healthcare) 60 days (individuals), ASAP (HHS if >500) HHS OCR
SEC (US Public Companies) 4 business days (Form 8-K) SEC
PCI DSS 72 hours Card brands/acquiring bank
NY DFS (23 NYCRR 500) 72 hours NY DFS
CCPA (California) "Expedient time" California AG
NIS2 (EU) 24 hours (early warning), 72 hours (full) National CSIRT

references/workflows.md (verbatim)

Workflows - Ransomware Tabletop Exercise

Workflow 1: Exercise Planning (4-6 weeks before)

Start
  |
  v
[Define exercise objectives] --> What gaps are we testing?
  |
  v
[Select scenario type]
  |-- Double extortion (data theft + encryption)
  |-- Supply chain ransomware (vendor compromise)
  |-- Cloud ransomware (SaaS/IaaS targeted)
  |-- Critical infrastructure disruption
  |
  v
[Choose threat actor model] --> LockBit / ALPHV / Cl0p / Rhysida
  |
  v
[Identify participants]
  |-- Executive leadership (CEO, CFO, COO)
  |-- IT/Security (CISO, SOC, IR team)
  |-- Legal (General Counsel, external counsel)
  |-- Communications (PR, media relations)
  |-- Operations (business unit leaders)
  |-- HR (employee communications)
  |-- External partners (IR firm, insurance)
  |
  v
[Develop scenario with 4 phases and injects]
  |
  v
[Prepare materials: SITREPs, inject cards, evaluation scorecard]
  |
  v
[Schedule 3-4 hour block, distribute pre-reading]
  |
  v
End

Workflow 2: Exercise Execution

Exercise Start
  |
  v
[Facilitator opening brief] (10 min)
  |-- Ground rules, objectives, scope
  |-- "This is discussion-based, no wrong answers"
  |
  v
[Phase 1: Initial Detection] (30 min)
  |-- Distribute SITREP 1
  |-- Discussion: Who, what, when, initial actions
  |-- Inject: Additional information changes situation
  |-- Document decisions on worksheet
  |
  v
[Phase 2: Escalation] (30 min)
  |-- Distribute SITREP 2
  |-- Discussion: Scope of impact, containment actions
  |-- Inject: Double extortion element introduced
  |-- Document decisions
  |
  v
[Break] (10 min)
  |
  v
[Phase 3: Critical Decision Points] (45 min)
  |-- Distribute SITREP 3
  |-- Discussion: Ransom payment, law enforcement, notification
  |-- Inject: Public pressure from media/customers
  |-- Document decisions with rationale
  |
  v
[Phase 4: Recovery and Communication] (45 min)
  |-- Distribute SITREP 4
  |-- Discussion: Recovery priority, timeline, customer comms
  |-- Inject: Recovery complication (infected backup, key system fails)
  |-- Document decisions
  |
  v
[Hot wash / Debrief] (20 min)
  |-- Each functional area shares top insight
  |-- Facilitator highlights key observations
  |-- Immediate gap identification
  |
  v
Exercise End

Workflow 3: After-Action Report Development

Exercise Complete
  |
  v
[Collect all documentation within 24 hours]
  |-- Decision worksheets
  |-- Facilitator notes
  |-- Evaluation scorecards
  |-- Observer notes (if separate observers present)
  |
  v
[Score each evaluation area (1-5)]
  |
  v
[Identify strengths (what worked well)]
  |
  v
[Identify gaps with severity rating]
  |-- Critical: Would prevent effective response
  |-- High: Would significantly delay/complicate response
  |-- Medium: Would reduce response quality
  |-- Low: Minor improvement opportunity
  |
  v
[Develop remediation actions]
  |-- Each gap gets: action, owner, deadline, priority
  |-- Must be specific and measurable
  |
  v
[Draft AAR within 5 business days]
  |
  v
[Review AAR with exercise sponsor]
  |
  v
[Distribute AAR to participants]
  |
  v
[Track remediation actions quarterly]
  |
  v
End

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.