Incident › Module 7 › Lesson 1
Ransomware Named
Ransomware literacy — impact categories, encryption scope, extortion vectors, defender response vocabulary — on YOUR `$IR_LAB` tabletop scenarios only.
Visual · t34_ransomware_named
Ransomware = named defender literacy. $IR_LAB tabletop. Original Cyberlium.
Opening
Ransomware incidents combine technical impact and business pressure — name defender vocabulary on YOUR lab tabletop, never payload creation or payment crime how-tos.
Ransomware literacy names: encryption impact category (files, shares, backups literacy stub), extortion vector category (note, leak threat literacy stub), initial access path category from tabletop stub, blast radius assessment category, and defender response phases (contain, eradicate, recover, notify literacy). Analyst documents ransomware scenario card on `$IR_LAB` instructor tabletop — fictional org, labeled assets, synthetic timeline — without building ransomware payloads, without testing encryptors on unauthorized systems, without criminal marketplace access. Cyberlium teaches defender decision literacy for tabletop exercises — YOUR notes under $HOME/cyberlium-lab/t34-ir/. Refused: payload creation, decryptor crime how-tos, payment negotiation scripts, prod impact without RoE. Lab row: ransomware scenario card (impact, vectors, scope, response phase stub).
1. Named ransomware impact rows
Encryption scope, extortion vector, initial access path, blast radius, response phases — five literacy anchors.
All assets fictional on `$IR_LAB` tabletop — not live victim org data.
Command guide
Try these commands — Named ransomware impact rows
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: CISA Stop Ransomware (https://www.cisa.gov/stopransomware); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender vocabulary
Contain before negotiate category — policy decision literacy, not crime how-to.
Link Module 5 containment and Module 6 eradication rows on same scenario thread.
3. $IR_LAB boundary
Tabletop scenario cards on YOUR notes only — not payload authoring.
Refused: ransomware build guides, payment negotiation crime how-tos, prod encryption tests.
4. What you ship: ransomware scenario card
Impact + vectors + scope + response phase stub + NEVER payload creation line.
5. What you record before the next lesson
Ransomware scenario card path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Build encryptor payload in lab VM as 'realistic ransomware training.'
Right
Ransomware scenario card from `$IR_LAB` tabletop stub. Next: Tabletop Flow.
Mission: ransomware scenario card
1) Name five ransomware literacy rows. 2) Fictional org and labeled assets. 3) Link containment/eradication rows. 4) Write NEVER payload creation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Encryption vs extortion-only — literacy split?”
Knowledge Check
APPLY: Ransomware literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Building encryptor payloads is course lab.
True or False
Knowledge Check
APPLY: Ransomware scenario card includes:
Multiple choice