After-Action ReportIllustrative Sample — No Customer Data

Ransomware Escalation Exercise

Ransomware at Calder Bay Fund Services

Report ID
AAR-SAMPLE-01
Classification
Illustrative Sample — No Customer Data
Exercise date
August 21, 2026
Duration
1h 12m
Facilitator
Rhea Kaur
Participants
6
Injects
6
Overall readiness
78%

Document Control

Reference
AAR-SAMPLE-01
Classification
Illustrative Sample — No Customer Data
Prepared by
Rhea Kaur
Generated
August 21, 2026 at 03:00 PM
Version
1.0
Review status
Not captured — not submitted for review
Reviewed by
Exercise Facilitator
Approved by
Chief Information Security Officer
Released
Not captured — not released
Distribution
Executive Leadership; Incident Response Team; Fund Operations; Compliance and Legal

Contents

1Executive Summary

Calder Bay Fund Services showed strong detection and technical containment. The team connected the VPN anomaly to the phishing report, preserved identity and endpoint evidence, and isolated the fund accounting servers with a clear owner. Readiness declined once the scenario required business decisions.

Isolation authority for the NAV calculation servers was not pre-delegated, so containment waited 9 minutes for sign-off. After exfiltration, a client notice was drafted before compliance confirmed the reporting obligation, and the ransom demand stalled compliance, legal, and client notification for 11 minutes. The two corrective actions below address authority and escalation and carry training and re-test evidence.

78%
Readiness
6
Injects
6 of 6
Scored
2
Findings
0
Critical

2Exercise Overview

2.1Exercise Profile

Exercise
Ransomware Escalation Exercise
Scenario
Ransomware at Calder Bay Fund Services
Commenced
Aug 21, 2026, 01:00 PM
Concluded
Aug 21, 2026, 02:12 PM
Duration
1h 12m
Injects presented
6
Facilitator
Rhea Kaur
Scenario profile
Financial Services · Ransomware / Data Exfiltration · Intermediate
Participants (6)
  • Samuel OseiSOC Analyst
  • Jin ParkIncident Response Lead
  • Anika VoraSecurity Engineer
  • Mei ChenCommunications Lead
  • Lucia DiazLegal Counsel
  • Petra NovakFund Operations Lead

2.2Exercise Objectives

3 defined for this scenario

  1. LO-01Contain ransomware spread and preserve forensic evidence.Success criteria set for this objective
    • Names who owns the incident before acting.
    • Lists the logs to preserve before any containment step.
  2. LO-02Coordinate compliance, legal, and client communications under time pressure.Success criteria set for this objective
    • Compliance confirms the reporting obligation before any client notice is drafted.
    • Names who convenes legal, compliance, and communications when a ransom demand arrives.
  3. LO-03Protect daily NAV production and restore fund accounting within the recovery objective.Success criteria set for this objective
    • Names the role with standing authority to isolate NAV production systems, with an alternate.

2.3Scenario and Injects

Ransomware at Calder Bay Fund Services

A phishing email lands in a fund accountant's inbox at Calder Bay Fund Services. The harvested credentials are reused over VPN, the attacker pivots over RDP to the NAV calculation servers, stages and copies out investor KYC records, and encrypts the fund accounting servers two hours before the daily pricing cut-off. Injects arrive in the order the team detects them, not the order the attacker moved. Participants must balance containment, evidence preservation, NAV production, and regulatory and client notification under time pressure.

Table 1. Inject catalogue, with severity and ATT&CK mapping.

#TimeInjectSeverityATT&CK
1T+00
Anomalous VPN login

Identity monitoring flags a fund accountant's account authenticating over VPN from an unfamiliar location and device.

low
T1078
2T+08
Phishing email reported

The same accountant reports a malicious invoice opened earlier that morning. The lure domain matches a credential-harvesting page.

medium
T1566
3T+15
Encryption event detected

EDR flags mass file modification on two fund accounting servers and an attempt to stop the EDR agent on one of them. The NAV team is locked out of shared drives two hours before the daily pricing cut-off. A ransom note titled READ_ME_NOW.txt appears in every affected directory.

high
T1486T1562.001
4T+27
Lateral movement to NAV servers

EDR shows the compromised account opening RDP sessions to the NAV calculation servers from a fund accounting workstation.

high
T1021
5T+38
Exfiltration attempt

Proxy logs show roughly 4 GB sent to an external host from the file server that holds investor KYC and onboarding records.

critical
T1074T1041
6T+52
Ransom demand received

The threat actor emails the COO with a ransom demand and a sample of investor records, threatening publication within 72 hours. Shadow copies on the encrypted servers have been deleted.

critical
T1486T1490

2.4Methodology and Scoring

Injects were presented in sequence by the facilitator. For each inject, participants answered its decision questions in writing, and the facilitator graded each answer individually as a percentage. An inject's grade is the mean of the questions actually graded on it, so a partially graded inject is scored over what was graded rather than diluted by implicit zeroes. The overall readiness figure is the mean of the graded injects.

Of 6 injects presented, 6 carried at least one graded question and 18 participant answers were recorded. Where a facilitator scored a question no participant answered, the score is reported and the answer is shown as not submitted — the report never quotes an answer that does not exist.

Table 2. Score bands and how each rating is interpreted.

BandRatingInterpretation
90–100%StrongResponse was complete, timely and correctly prioritised.
70–89%GoodResponse was sound with minor omissions. Meets the passing threshold.
50–69%AdequateResponse was partially correct but missed material steps.
0–49%Needs improvementResponse was absent, incorrect, or would have worsened the incident.
—Not scoredThe facilitator did not grade this item. Excluded from the overall percentage — it is not a zero.

Two severity scales appear in this report and they are not the same. Inject severity (LOW / MEDIUM / HIGH / CRITICAL) describes the scenario event the team was presented with. Finding severity (medium / high / critical) describes the risk carried by a shortfall the exercise revealed. A LOW-severity inject can produce a critical finding.

3Exercise Results

3.1Readiness Score

Overall readiness
78%Good
Mean of 6 graded injects · 2 gaps
Distribution across score bands
Strong (1)Good (4)Adequate (1)
Median time to respond
3 min 45 s18 of 18 answers timed
Participation
6 of 6assigned analysts answered

3.2Performance by Inject

6 injects evaluated

Table 3. Score and severity by inject.

#InjectSeverityScoreGaps
1Anomalous VPN loginlow92%—
2Phishing email reportedmedium84%—
3Encryption event detectedhigh85%—
4Lateral movement to NAV servershigh71%—
5Exfiltration attemptcritical66%—
6Ransom demand receivedcritical71%—

Figure 1. Inject scores against the 80% target threshold.

80% targetInject 192%Inject 284%Inject 385%Inject 471%Inject 566%Inject 671%

Figure 2. Score for each graded question, against the 80% target.

80% target1.195%1.290%1.391%2.188%2.282%2.382%3.185%3.278%3.392%4.180%4.258%4.375%5.170%5.260%5.368%6.164%6.277%6.372%
#1

Anomalous VPN login

low
92%Strong

AI Analysis

The team named an owner, revoked the session, and listed the evidence to preserve before acting. The 92% score reflects a fast, traceable response.

Responses & Scoring (3)

  1. Q1. What is your first action and who owns it?

    95%
    The SOC validates the login against the user's travel and device record, the IR lead opens the incident, and identity revokes the session and forces a credential reset.

    — Samuel Osei

    Facilitator: Clear owner and sequence.

  2. Q2. Which evidence must be preserved before containment?

    90%
    VPN concentrator logs, identity-provider sign-in records, MFA push history, and EDR telemetry for the accountant's endpoint.

    — Anika Vora

    Facilitator: Evidence set was specific and usable.

  3. Q3. What would move this to a major incident?

    91%
    Any sign the credentials reached fund accounting or NAV systems, or a second account showing the same pattern.

    — Jin Park

    Facilitator: Threshold tied to business impact.

Facilitator notes: Ownership was clear from the first minute. The team separated identity containment from evidence collection and recorded the decision owner.

#2

Phishing email reported

medium
84%Good

AI Analysis

Participants correctly treated the VPN login as the result of credential harvesting and scoped the phishing campaign. The 84% score reflects an undefined threshold for engaging compliance.

Responses & Scoring (3)

  1. Q1. How do you connect the phishing report to the VPN alert?

    88%
    The invoice came from the same lure domain seen in the accountant's mail logs. We treat the VPN login as the result of credential harvesting and merge both alerts into one incident.

    — Samuel Osei

    Facilitator: Correct attribution of the attacker's first step.

  2. Q2. Which mailboxes and users are in scope?

    82%
    Search all mailboxes for the sender domain and attachment hash, purge matches, and check which recipients opened the attachment.

    — Anika Vora

    Facilitator: Sound scoping; credential resets for other openers were added after discussion.

  3. Q3. Who needs to know at this stage?

    82%
    The IR lead, the head of fund accounting, and the CISO. Compliance joins once there is evidence of data access.

    — Jin Park

    Facilitator: Reasonable, but the compliance threshold was not defined.

Facilitator notes: Good correlation between the two alerts. The threshold for engaging compliance was not stated.

#3

Encryption event detected

high
85%Good

AI Analysis

Containment of the fund accounting servers was well sequenced and properly authorized. The response reached 85%; DR failover was proposed before the DR site was confirmed clean.

Responses & Scoring (3)

  1. Q1. What are your first three containment actions — and who has the authority to isolate production systems?

    85%
    Isolate both fund accounting servers via EDR containment, block east-west RDP at the core switch, page the IR lead per the ransomware runbook.

    — Samuel Osei

    Facilitator: Correct actions; authority named for the file servers.

  2. Q2. How do you protect today's NAV run?

    78%
    Pull the two servers off the network, snapshot for forensics, and confirm with the NAV lead whether today's pricing run can move to the DR site.

    — Anika Vora

    Facilitator: Practical, but did not confirm the DR site was clean before failover.

  3. Q3. What do you confirm before isolating?

    92%
    Confirm scope from EDR telemetry before isolating — then invoke the major-incident bridge and bring in compliance to assess regulatory notification.

    — Jin Park

    Facilitator: Scope first, then escalation. Compliance named.

Facilitator notes: Strong containment sequence. The DR site was proposed for failover before anyone confirmed it was clean.

#4

Lateral movement to NAV servers

high
71%Good

AI Analysis

The team understood the required isolation but could not name who held authority over business-owned NAV production. The lowest question score was 58% and the decision took 9 minutes.

Responses & Scoring (3)

  1. Q1. The attacker has RDP access to the NAV calculation servers. What do you do?

    80%
    Block RDP to the NAV segment from everything except the jump host, isolate the two NAV calculation servers, and hunt for the same account on other hosts.

    — Samuel Osei

    Facilitator: Correct actions in a sensible order.

  2. Q2. Who can authorize isolating the NAV calculation servers ahead of the pricing cut-off?

    58%
    Fund operations needs sign-off from the head of fund accounting before taking NAV production offline. We would brief them and wait.

    — Petra Novak

    Facilitator: No pre-delegated authority or alternate for NAV production; the decision took 9 minutes.

  3. Q3. What is the fallback if NAV cannot be struck today?

    75%
    Notify the depositary and affected funds of a possible delayed NAV, prepare manual pricing from the prior day's positions, and log the decision.

    — Petra Novak

    Facilitator: Workable fallback with the right external parties.

Facilitator notes: The technical action was understood. Security held authority for the file servers but not for business-owned NAV production systems, and no alternate was named.

#5

Exfiltration attempt

critical
66%Adequate

AI Analysis

Exfiltration scope was stated with appropriate caution, but notification started in the wrong order. The 66% score reflects a client notice drafted before compliance confirmed the obligation.

Responses & Scoring (3)

  1. Q1. What data has left the environment, and how confident are you?

    70%
    Proxy and firewall logs show about 4 GB to an external host from the file server holding investor onboarding records. We cannot yet confirm which files.

    — Anika Vora

    Facilitator: Honest confidence statement; scoping plan was thin.

  2. Q2. What regulatory and client obligations does this trigger, and who decides?

    60%
    We drafted a notice to affected investors so it is ready to send as soon as the scope is confirmed.

    — Petra Novak

    Facilitator: Client notice drafted before compliance confirmed the reporting obligation.

  3. Q3. Who must be notified, and in what order?

    68%
    Compliance confirms the regulatory reporting obligation and deadline first, legal reviews contractual notice terms with fund clients, then communications issues approved notices.

    — Lucia Diaz

    Facilitator: Correct sequence, stated after the notice was already drafted.

Facilitator notes: Legal set out the correct sequence once asked. Notification work started in the wrong order and without a clear owner.

#6

Ransom demand received

critical
71%Good

AI Analysis

Restore priorities and the holding statement were sound. The 71% score reflects an 11-minute stall while the team worked out who convenes legal, compliance, and executive decision-makers.

Responses & Scoring (3)

  1. Q1. Who decides how to respond to the ransom demand?

    64%
    The IR lead escalates to the CISO, but our runbook does not say who convenes legal, compliance, and the board for a ransom decision.

    — Jin Park

    Facilitator: Escalation path unclear; notification decisions stalled for 11 minutes.

  2. Q2. What restore order protects fund operations?

    77%
    Restore fund accounting from the last immutable backup to a clean segment, validate integrity, then bring NAV calculation back before investor services.

    — Anika Vora

    Facilitator: Priority and validation step were clear.

  3. Q3. What do you tell clients and the board now?

    72%
    A holding statement confirming a contained incident, the expected NAV delay, and the time of the next update, approved by legal.

    — Mei Chen

    Facilitator: Appropriate content; approval owner named late.

Facilitator notes: The runbook covered technical response to ransomware but not who convenes legal, compliance, and executive decision-makers when a demand arrives.

4Findings

2 findings — observation, implication and recommendation

AAR-01

NAV production isolation authority was not pre-delegated

high

Observation.Inject 4 recorded that fund operations would brief the head of fund accounting and wait; the question scored 58%, no alternate was named, and the decision took 9 minutes.

Q2. Who can authorize isolating the NAV calculation servers ahead of the pricing cut-off?

“Fund operations needs sign-off from the head of fund accounting before taking NAV production offline. We would brief them and wait.”
— Petra Novak · Inject 4 · scored 58%

Implication.A delay at this point extends attacker access to NAV production close to the pricing cut-off and increases the chance of a missed or incorrect NAV.

Recommendation.Pre-delegate isolation authority for NAV production to the IR lead with a named business alternate, and document the thresholds that trigger it.

Source: Inject 4 — 71% │ Corrective actions: CAP-01

AAR-02

Ransom escalation and notification sequence were unclear

high

Observation.Inject 5 recorded a client notice drafted by the operations lead before compliance confirmed the reporting obligation. Inject 6 recorded an 11-minute stall before compliance, legal, and communications were convened.

Q2. What regulatory and client obligations does this trigger, and who decides?

“We drafted a notice to affected investors so it is ready to send as soon as the scope is confirmed.”
— Petra Novak · Inject 5 · scored 60%

Implication.Notices sent out of sequence can breach regulatory timelines or contractual terms, and delayed escalation leaves leadership deciding without legal and compliance input.

Recommendation.Add a ransomware escalation tree to IR plan §4 naming who convenes compliance, legal, and communications, with compliance confirming obligations before any client notice.

Source: Inject 5 — 66%; Inject 6 — 71% │ Corrective actions: CAP-02

5Strengths

  • S-01The VPN anomaly and phishing report were merged into one incident, revealing the attacker's first step early.
  • S-02Identity, VPN, and endpoint evidence was preserved before containment.
  • S-03Fund accounting servers were isolated with a clear sequence and owner.

6Lessons Learned

4 lessons with corrective-action owners

Table 4. Lessons learned, with corrective-action owners.

CategoryPriorityLessonOwnerSource
Change requiredhighAuthority over business-owned systems must be exercised under time pressure, not only documented; validate the revised matrix in a targeted re-test.Incident Response LeadAI-proposed
Change requiredhighCompliance confirms reporting obligations before client or investor communications are drafted.Legal CounselAI-proposed
Worked wellmediumMerging the phishing report and the VPN alert into one incident gave the team the attacker's real first step early.SOC AnalystFacilitator
Change requiredmediumCompliance should join the bridge when data access becomes plausible, before anyone drafts client communications.Legal CounselFacilitator

7Facilitator Notes

Inject 1 — Anomalous VPN login: • Ownership was clear from the first minute. The team separated identity containment from evidence collection and recorded the decision owner. Inject 2 — Phishing email reported: • Good correlation between the two alerts. The threshold for engaging compliance was not stated. Inject 3 — Encryption event detected: • Strong containment sequence. The DR site was proposed for failover before anyone confirmed it was clean. Inject 4 — Lateral movement to NAV servers: • The technical action was understood. Security held authority for the file servers but not for business-owned NAV production systems, and no alternate was named. Inject 5 — Exfiltration attempt: • Legal set out the correct sequence once asked. Notification work started in the wrong order and without a clear owner. Inject 6 — Ransom demand received: • The runbook covered technical response to ransomware but not who convenes legal, compliance, and executive decision-makers when a demand arrives. General: • Session revoked, credential reset forced, and evidence set recorded. • Fund accounting servers isolated; east-west RDP blocked. • NAV calculation server isolation approved, 9 minutes after the inject. • NAV production isolation authority gap recorded for follow-up. • Client notice drafted before compliance confirmed the reporting obligation. • Compliance, legal, and communications convened, 11 minutes after the ransom demand. • The team linked the VPN anomaly to the phishing report quickly and contained the fund accounting servers with a clear sequence. Readiness fell as the scenario moved from technical containment to business decisions. Security held authority to isolate the file servers but not the NAV calculation servers, so the team waited 9 minutes for sign-off ahead of the pricing cut-off. When data left the environment, the operations lead drafted a client notice before compliance had confirmed the reporting obligation, and the ransom demand exposed that no one owned convening legal, compliance, and communications. A follow-up exercise should re-test the revised authority matrix and escalation tree.

8Corrective Action Plan

2 actions — 0 awaiting an owner

Table 5. Corrective action plan, with owner, due date and re-test status.

RefActionOwnerDueStatusTraining
CAP-01Pre-delegate isolation authority for NAV production to the IR lead, name a business alternate, and document the thresholds that trigger it.
highcloses AAR-01 — NAV production isolation authority was not pre-delegatedevidence requiredre-test required
Incident Response Lead2026-09-20in progress2 analysts — 1 completed, 1 in progress, re-test 0/2 passed
CAP-02Add a ransomware escalation tree to IR plan §4 naming who convenes compliance, legal, and communications, with compliance confirming obligations before any client notice.
highcloses AAR-02 — Ransom escalation and notification sequence were unclearevidence requiredre-test required
Legal Counsel2026-10-04open1 analyst — 1 assigned, re-test 0/1 passed

Training gaps are recorded per analyst — raising one for the team creates a record for each member.

Appendix AEvidence Timeline

56 events recorded

Table A.1. Evidence timeline, in the order the platform recorded it.

TimeEventActor
01:00 PMExercise startedRhea Kaur
01:04 PMResponse submitted: "The SOC validates the login against the user's travel and device record, the IR lead opens the incid…" (2 min 30 s after reveal)Samuel Osei
01:04 PM"Anomalous VPN login" scored: 95%Rhea Kaur
01:06 PMResponse submitted: "VPN concentrator logs, identity-provider sign-in records, MFA push history, and EDR telemetry for th…" (2 min 50 s after reveal)Anika Vora
01:07 PM"Anomalous VPN login" scored: 90%Rhea Kaur
01:08 PMNote: "Session revoked, credential reset forced, and evidence set recorded."Rhea Kaur
01:09 PMResponse submitted: "Any sign the credentials reached fund accounting or NAV systems, or a second account showing the sam…" (2 min 40 s after reveal)Jin Park
01:09 PM"Anomalous VPN login" scored: 91%Rhea Kaur
01:09 PMQuestion note: "Ownership was clear from the first minute. The team separated identity containment from evidence col…"Rhea Kaur
01:10 PMInject 1 completed: "Anomalous VPN login"Rhea Kaur
01:13 PMResponse submitted: "The invoice came from the same lure domain seen in the accountant's mail logs. We treat the VPN logi…" (3 min 10 s after reveal)Samuel Osei
01:13 PM"Phishing email reported" scored: 88%Rhea Kaur
01:14 PMResponse submitted: "Search all mailboxes for the sender domain and attachment hash, purge matches, and check which recip…" (3 min 30 s after reveal)Anika Vora
01:14 PM"Phishing email reported" scored: 82%Rhea Kaur
01:16 PMResponse submitted: "The IR lead, the head of fund accounting, and the CISO. Compliance joins once there is evidence of d…" (3 min 20 s after reveal)Jin Park
01:17 PM"Phishing email reported" scored: 82%Rhea Kaur
01:17 PMInject 2 completed: "Phishing email reported"Rhea Kaur
01:17 PMQuestion note: "Good correlation between the two alerts. The threshold for engaging compliance was not stated."Rhea Kaur
01:20 PMResponse submitted: "Isolate both fund accounting servers via EDR containment, block east-west RDP at the core switch, pa…" (3 min 25 s after reveal)Samuel Osei
01:20 PM"Encryption event detected" scored: 85%Rhea Kaur
01:24 PMNote: "Fund accounting servers isolated; east-west RDP blocked."Rhea Kaur
01:24 PMResponse submitted: "Pull the two servers off the network, snapshot for forensics, and confirm with the NAV lead whether …" (3 min 55 s after reveal)Anika Vora
01:24 PM"Encryption event detected" scored: 78%Rhea Kaur
01:27 PMResponse submitted: "Confirm scope from EDR telemetry before isolating — then invoke the major-incident bridge and bring …" (3 min 40 s after reveal)Jin Park
01:28 PM"Encryption event detected" scored: 92%Rhea Kaur
01:28 PMQuestion note: "Strong containment sequence. The DR site was proposed for failover before anyone confirmed it was cl…"Rhea Kaur
01:29 PMInject 3 completed: "Encryption event detected"Rhea Kaur
01:33 PMResponse submitted: "Block RDP to the NAV segment from everything except the jump host, isolate the two NAV calculation s…" (4 min after reveal)Samuel Osei
01:33 PM"Lateral movement to NAV servers" scored: 80%Rhea Kaur
01:37 PMResponse submitted: "Fund operations needs sign-off from the head of fund accounting before taking NAV production offline…" (4 min 50 s after reveal)Petra Novak
01:38 PMNote: "NAV calculation server isolation approved, 9 minutes after the inject."Rhea Kaur
01:38 PM"Lateral movement to NAV servers" scored: 58%Rhea Kaur
01:38 PMNote: "NAV production isolation authority gap recorded for follow-up."Rhea Kaur
01:39 PMResponse submitted: "Notify the depositary and affected funds of a possible delayed NAV, prepare manual pricing from the …" (4 min 10 s after reveal)Petra Novak
01:40 PM"Lateral movement to NAV servers" scored: 75%Rhea Kaur
01:40 PMInject 4 completed: "Lateral movement to NAV servers"Rhea Kaur
01:40 PMQuestion note: "The technical action was understood. Security held authority for the file servers but not for busine…"Rhea Kaur
01:43 PMResponse submitted: "Proxy and firewall logs show about 4 GB to an external host from the file server holding investor on…" (3 min 50 s after reveal)Anika Vora
01:44 PM"Exfiltration attempt" scored: 70%Rhea Kaur
01:48 PMResponse submitted: "We drafted a notice to affected investors so it is ready to send as soon as the scope is confirmed." (4 min 30 s after reveal)Petra Novak
01:48 PM"Exfiltration attempt" scored: 60%Rhea Kaur
01:49 PMNote: "Client notice drafted before compliance confirmed the reporting obligation."Rhea Kaur
01:52 PMResponse submitted: "Compliance confirms the regulatory reporting obligation and deadline first, legal reviews contractua…" (4 min after reveal)Lucia Diaz
01:53 PM"Exfiltration attempt" scored: 68%Rhea Kaur
01:53 PMQuestion note: "Legal set out the correct sequence once asked. Notification work started in the wrong order and with…"Rhea Kaur
01:54 PMInject 5 completed: "Exfiltration attempt"Rhea Kaur
01:57 PMResponse submitted: "The IR lead escalates to the CISO, but our runbook does not say who convenes legal, compliance, and …" (3 min 40 s after reveal)Jin Park
01:58 PM"Ransom demand received" scored: 64%Rhea Kaur
02:03 PMResponse submitted: "Restore fund accounting from the last immutable backup to a clean segment, validate integrity, then …" (4 min 10 s after reveal)Anika Vora
02:03 PM"Ransom demand received" scored: 77%Rhea Kaur
02:05 PMNote: "Compliance, legal, and communications convened, 11 minutes after the ransom demand."Rhea Kaur
02:08 PMResponse submitted: "A holding statement confirming a contained incident, the expected NAV delay, and the time of the nex…" (3 min 50 s after reveal)Mei Chen
02:08 PM"Ransom demand received" scored: 72%Rhea Kaur
02:09 PMQuestion note: "The runbook covered technical response to ransomware but not who convenes legal, compliance, and exe…"Rhea Kaur
02:11 PMNote: "The team linked the VPN anomaly to the phishing report quickly and contained the fund accounting ser…"Rhea Kaur
02:12 PMExercise completedRhea Kaur

Appendix BTeam Communications

6 messages exchanged during the exercise

6 messages from 5 participants, in the order sent.

  1. 01:05 PMSamuel OseiVPN session revoked. Pulling MFA history before the reset goes through.
  2. 01:13 PMSamuel OseiPhishing lure domain matches the VPN account. Merging into one incident.
  3. 01:22 PMAnika VoraBoth fund accounting servers contained in EDR. Snapshots running.
  4. 01:34 PMJin ParkWe need the NAV servers offline now. Who can sign that off before the cut-off?
  5. 01:47 PMLucia DiazPlease hold the investor notice. Compliance has to confirm the reporting obligation first.
  6. 01:59 PMMei ChenI need one owner for the ransom response before anything goes to clients or the board.

Appendix CMITRE ATT&CK Coverage

Techniques exercised by this scenario, by tactic

8 distinct ATT&CK techniques across 6 tactics, mapped from 6 of 6 injects.

Table C.1. ATT&CK techniques exercised, by tactic.

TacticTechniqueNameInjectsMean score
CollectionT1074Data Staged566%
Defense EvasionT1562.001Disable or Modify Tools385%
ExfiltrationT1041Exfiltration Over C2 Channel566%
ImpactT1486Data Encrypted for Impact3, 678%
T1490Inhibit System Recovery671%
Initial AccessT1078Valid Accounts192%
T1566Phishing284%
Lateral MovementT1021Remote Services471%

Figure C.1. Injects exercising each ATT&CK tactic.

Collection1/6 · 1TDefense Evasion1/6 · 1TExfiltration1/6 · 1TImpact2/6 · 2TInitial Access2/6 · 2TLateral Movement1/6 · 1T

Appendix DData Quality

What this report is, and is not, evidenced by

Table D.1. Evidence sources behind this report, and what each one supports.

Evidence sourceStatusDetail
Facilitator scoresPresent6 of 6 injects carry at least one graded question.
Participant answersPresent18 answers recorded in the participants' own words.
Facilitator overridesPresentNo question was scored without an answer behind it.
Facilitator notesPresentNotes were recorded during the exercise.
Event timelinePresent56 timed events recorded (9.33 per inject).
Team chatPresent6 messages recorded and reproduced verbatim in the appendix.
Response latencyPresentMedian 3 min 45 s from reveal to submit (fastest 2 min 30 s, slowest 4 min 50 s); all 18 answers timed.

The headline completeness figure of 100% weights participant answers 40%, facilitator scores 25%, timeline density 20% and facilitator notes 15%. It is a measure of how much evidence exists, not of how well the team performed. The table above is what it decomposes into.

After-Action Report AAR-SAMPLE-01Illustrative Sample — No Customer Data

Provenance: AAR-SAMPLE-01 · 100% data completeness