All tabletop exercises
Insider·Advanced·Technical audience
A passed-over admin leaves scheduled sabotage behind
The prompt — read this to the room
Two weeks after being told he would not get the infrastructure lead role, a senior systems administrator at a 1,500-person healthcare billing company resigns with immediate effect. His accounts were disabled within the hour. Three days later, at 01:00, scheduled tasks on twelve servers delete the database backups and drop a production claims table. The tasks were created months ago under a service account he set up, which nobody has rotated. Claims processing is down. How much else has he left behind, and how do you find it before the next one fires?
Total duration
2 h 30 min
People to involve
7
Best fit
Healthcare
Who to involve
Most important first.
- Incident response lead
- IT operations
- Cloud engineer
- CISO / Head of security
- CIO / CTO
- HR
- Legal counsel
What it tests
- Hunt for further persistence left by a privileged insider across on-premises and cloud estates.
- Recover claims processing when backups themselves were targeted.
- Rotate every credential the former admin knew without breaking production.
- Preserve evidence for possible criminal referral and handle HIPAA questions correctly.
Outline of activities
- 1The 01:00 deletions and what was lost
- 2Stop the next one: hunting scheduled tasks, scripts and credentials
- 3Recovery without trustworthy backups
- 4Credential rotation at scale
- 5Evidence, law enforcement and regulatory questions
- 6Why the leaver process missed it
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…