Incident › Module 7 › Lesson 4
Lab — Ransomware
Ransomware tabletop lab on `$IR_LAB` — scenario card, tabletop agenda, payment decision matrix bundled.
Visual · t34_ransomware_lab
Lab: ransomware tabletop pack on YOUR $IR_LAB. Original Cyberlium.
Opening
Ship ransomware tabletop artifacts from YOUR lab stub — scenario, agenda, payment ethics — zero payloads, zero payment crime how-tos, zero unauthorized prod notifications.
On YOUR `$IR_LAB` per brief: (1) scope proof — labeled tabletop scenario under $HOME/cyberlium-lab/t34-ir/; (2) ransomware scenario card Module 7-1; (3) tabletop agenda with three injects Module 7-2; (4) payment decision matrix Module 7-3; (5) hotwash preview stub (decisions made, gaps noted); (6) integrity — `$IR_LAB` only, no payload creation, no payment negotiation crime how-tos, no unauthorized prod customer comms; (7) chmod 600 pack. Cross-link Modules 5–6 containment/eradication/recovery — tabletop exercises defender decisions only.
1. Lab deliverables
Scenario + agenda + payment matrix cross-indexed — single tabletop thread.
Hotwash preview links gaps to Module 9 lessons learned preview.
Command guide
Try these commands — Lab deliverables
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics bar
Zero payload references; zero payment crime how-tos; fictional org only.
Decision prompts list defender policy options — not criminal scripts.
3. Teardown
Secure notes chmod 600; no tabletop outputs sent to real stakeholders without authorization.
Archive stub optional per brief.
4. What you ship: ransomware tabletop pack
Scenario + agenda + payment matrix + hotwash stub + integrity — chmod 600.
5. What you record before the next lesson
Ransomware tabletop pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Ransomware lab includes encryptor build walkthrough as bonus deliverable.
Right
Ransomware tabletop pack on `$IR_LAB`. Next: quiz.
Mission: ransomware tabletop lab
1) Scope and scenario proof. 2) Scenario card and tabletop agenda. 3) Payment decision matrix. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum hotwash rows if brief sparse?”
Knowledge Check
APPLY: Ransomware lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Encryptor payloads earn lab credit.
True or False
Knowledge Check
APPLY: Ransomware lab pack should:
Multiple choice