Incident › Module 7 › Lesson 4
Lab — Ransomware
Ransomware tabletop lab on `$IR_LAB` — scenario card, tabletop agenda, payment decision matrix bundled.
Visual · t34_ransomware_lab
Lab: ransomware tabletop pack on YOUR $IR_LAB. Original Cyberlium.
Opening
Ship ransomware tabletop artifacts from YOUR lab stub — scenario, agenda, payment ethics — zero payloads, zero payment crime how-tos, zero unauthorized prod notifications.
On YOUR `$IR_LAB` per brief: (1) scope proof — labeled tabletop scenario under $HOME/cyberlium-lab/t34-ir/; (2) ransomware scenario card Module 7-1; (3) tabletop agenda with three injects Module 7-2; (4) payment decision matrix Module 7-3; (5) hotwash preview stub (decisions made, gaps noted); (6) integrity — `$IR_LAB` only, no payload creation, no payment negotiation crime how-tos, no unauthorized prod customer comms; (7) chmod 600 pack. Cross-link Modules 5–6 containment/eradication/recovery — tabletop exercises defender decisions only.
1. Lab deliverables
Scenario + agenda + payment matrix cross-indexed — single tabletop thread.
Hotwash preview links gaps to Module 9 lessons learned preview.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/scenarios/LAB-IR-RANSOM-001.md" <<'EOF'
# Incident Card: LAB-IR-RANSOM-001 (FAKE — tabletop only)
**Classification:** Fictional training scenario — NO real malware
## Summary
Finance lab VM (finance-lab-vm.internal.example) shows encrypted files + ransom note text file.
## Timeline (UTC fictional)
- 08:00 — User reports unable to open spreadsheets
- 08:15 — SOC EDR alert: mass file modification on finance-lab-vm
- 08:30 — IR lead activated; Sev-1 declared (tabletop)
## Affected assets (fictional)
- Host: finance-lab-vm (192.168.50.10 RFC1918 lab)
- Scope: single VLAN segment LAB-FINANCE
## Indicators (descriptive only — not payloads)
- Ransom note filename: READ_ME_LAB.txt
- Backup service disabled (simulated in scenario inject)
## Decisions to document (tabletop)
1. Containment per decision-tree.md
2. Comms per comms/internal-status-template.md
3. Recovery from offline backup — no payment
## Integrity
- No ransomware binaries; no payment how-to; YOUR lab markdown only
EOFCommand — copy this
grep -E 'FAKE|finance-lab-vm|no payment|NO real malware' "$IR_LAB/scenarios/LAB-IR-RANSOM-001.md"
grep NEVER "$IR_LAB/scenarios/payment-ethics.txt" "$IR_LAB/notes/no-stranger-ir.txt"
python3 -c "print('Ransomware lab: LAB-IR-RANSOM-001 seeded — markdown tabletop only')"═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/scenarios/LAB-IR-RANSOM-001.md | Select-String FAKE
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics bar
Zero payload references; zero payment crime how-tos; fictional org only.
Decision prompts list defender policy options — not criminal scripts.
3. Teardown
Secure notes chmod 600; no tabletop outputs sent to real stakeholders without authorization.
Archive stub optional per brief.
4. What you ship: ransomware tabletop pack
Scenario + agenda + payment matrix + hotwash stub + integrity — chmod 600.
5. What you record before the next lesson
Ransomware tabletop pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Ransomware lab includes encryptor build walkthrough as bonus deliverable.
Right
Ransomware tabletop pack on `$IR_LAB`. Next: quiz.
Mission: ransomware tabletop lab
1) Scope and scenario proof. 2) Scenario card and tabletop agenda. 3) Payment decision matrix. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum hotwash rows if brief sparse?”
Knowledge Check
APPLY: Ransomware lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Encryptor payloads earn lab credit.
True or False
Knowledge Check
APPLY: Ransomware lab pack should:
Multiple choice