From cybersecurity-skills
Plans and facilitates ransomware tabletop exercises testing organizational readiness, decision-making, and communication against NIST CSF/CISA. Covers LockBit/ALPHV/Cl0p scenarios with double extortion and notifications.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
- Testing organizational ransomware response procedures annually or after major infrastructure changes
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Do not use as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.
Build a realistic scenario based on current threat actor TTPs:
Scenario Structure:
Phase 1: Initial Detection (30 min)
- SOC receives alert for suspicious process execution on file server
- EDR detects Cobalt Strike beacon on 3 workstations
- Inject: External threat intel report links C2 IP to LockBit affiliate
Phase 2: Escalation (30 min)
- Ransomware executes on 40% of servers during overnight hours
- Ransom note demands $2M in Bitcoin with 72-hour deadline
- Inject: Attackers contact media claiming data theft of customer PII
Phase 3: Decision Points (45 min)
- Backup assessment reveals immutable copies are intact but primary backups encrypted
- Legal advises on breach notification timeline (72 hours GDPR, varies by US state)
- Inject: Threat actor publishes sample of stolen data on leak site
Phase 4: Recovery and Communication (45 min)
- Recovery time estimate: 5-7 days from immutable backups
- Insurance carrier engages negotiation firm
- Inject: Major customer threatens contract termination without update within 24 hours
Scenario Variables to Customize:
Create the following documents for participants:
Key Decision Points to Include:
Facilitator Responsibilities:
Probing Questions by Phase:
Phase 1 - Detection:
Phase 2 - Escalation:
Phase 3 - Decision:
Phase 4 - Recovery:
Score each functional area against defined criteria:
| Evaluation Area | Score (1-5) | Criteria |
|---|---|---|
| Detection & Escalation | Timely incident declaration, proper chain of command | |
| Containment | Network isolation, credential reset, scope assessment | |
| Communication - Internal | Employee notification, executive briefing, documented decisions | |
| Communication - External | Regulatory notification, customer communication, media response | |
| Recovery Planning | Backup verification, recovery priority, RTO tracking | |
| Legal & Compliance | Breach notification timelines, evidence preservation, law enforcement engagement | |
| Business Continuity | Manual operations, customer impact mitigation, revenue loss estimation | |
| Payment Decision | Structured framework, legal review, OFAC sanctions check |
Produce an after-action report (AAR) within 5 business days:
AAR Contents:
| Term | Definition |
|---|---|
| Tabletop Exercise (TTX) | Discussion-based exercise where participants walk through a simulated incident scenario to test plans and procedures |
| Inject | New information introduced during the exercise to change the scenario and force additional decision-making |
| SITREP | Situation Report providing current status of the simulated incident at each exercise phase |
| After-Action Report (AAR) | Post-exercise document capturing findings, gaps, strengths, and remediation actions |
| Double Extortion | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless ransom is paid |
| OFAC Check | Verification that ransom payment recipient is not on the US Treasury OFAC sanctions list, which would make payment illegal |
Context: A 5-hospital healthcare system conducts an annual ransomware tabletop. Previous exercise revealed gaps in HIPAA breach notification and clinical system recovery priority. This year's scenario simulates a double extortion attack targeting the EMR system.
Approach:
Pitfalls:
## Ransomware Tabletop Exercise - After Action Report
**Exercise Date**: [Date]
**Facilitator**: [Name]
**Scenario**: [Brief description]
**Duration**: [Hours]
**Participants**: [Count by department]
### Exercise Objectives
1. [Objective] - Met / Partially Met / Not Met
2. [Objective] - Met / Partially Met / Not Met
### Key Decisions Log
| Time | Decision Point | Decision Made | Rationale | Assessment |
|------|---------------|--------------|-----------|------------|
### Strengths Observed
1. [Strength]
### Gaps Identified
| Gap | Severity | Affected Area | Current State | Desired State |
|-----|----------|--------------|---------------|---------------|
### Remediation Actions
| Action | Owner | Deadline | Priority | Status |
|--------|-------|----------|----------|--------|
### Comparison to Previous Exercise
| Area | Previous Score | Current Score | Trend |
|------|---------------|--------------|-------|