All tabletop exercises
Ransomware·Intermediate·Technical audience
Reinfected on day six of the recovery
The prompt — read this to the room
Six days into recovering from ransomware at a regional hospital, about 70% of servers have been rebuilt and clinical systems are coming back online. Then EDR on a freshly restored file server flags the same loader seen at the start of the incident, calling out to a new domain. Two domain controllers were restored from backup rather than rebuilt from scratch. Clinicians have been told everything will be back by Monday. Do you halt the recovery, and how do you find what you missed?
Total duration
2 h
People to involve
5
Best fit
Healthcare
Who to involve
Most important first.
- Incident response lead
- IT operations
- SOC analyst
- CISO / Head of security
- CIO / CTO
What it tests
- Decide whether to pause, partially pause or continue recovery, based on evidence and patient-safety impact
- Find the persistence or re-entry path the first eradication missed
- Rebuild trust in identity infrastructure, including the restored domain controllers
- Set recovery gates so nothing returns to production without meeting a clean-build standard
Outline of activities
- 1The alert on a restored server
- 2Pause or continue: clinical impact versus spread
- 3Hunting for what was missed: backups, DCs, accounts, tools
- 4Rebuilding identity the hard way
- 5New recovery gates and a revised timeline for clinicians
- 6Debrief: eradication you can prove
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…