Edge VPN Intrusion Lab
An SSL-VPN appliance is exploited, a webshell harvests passwords, and the attacker reaches the domain controller. Make eight to ten branching decisions — patch or image first, which credentials to burn, krbtgt, C2 and rebuild — and export a scored debrief.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A vendor advisory lands on a Friday: the SSL-VPN appliance Harbourline Freight uses for remote access is being exploited in the wild. Your appliance shows signs it is one of the victims. Make the calls as incident lead — evidence or patch first, which credentials to burn, what to do when the attacker reaches the domain controller, and how to get them out for good — and get a scored debrief.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- A realistic edge-device intrusion: an advisory, integrity-checker output, a webshell credential log, replication requests from a non-DC and a forged Kerberos ticket.
- The story branches: patch-and-reboot first destroys the evidence and you work blind; a quick partial fix brings the attacker back with a golden ticket.
- Each decision is scored 0–10 with feedback on why, what it costs and what it does to the evidence and the clock.
- Rename the organisation, appliance and domain controller so the rehearsal fits your environment, then export the debrief (Pro).
Frequently asked questions
Is the VPN vendor real?
No. The vendor, advisory ID, file paths and IP addresses are fictional (the IPs are in ranges reserved for documentation). The pattern — an exploited edge appliance, a webshell that logs passwords, then lateral movement to the domain — is common across real incidents.
What is the most common mistake in this kind of incident?
Patching and rebooting the appliance before capturing it. The advisory says patch, the change window is open, and it feels responsible. But the reboot usually wipes the webshell and the credential log — the evidence that tells you how long the attacker was in and whose passwords they took.
Who should run this lab?
Network and infrastructure leads, SOC and IR staff, and the identity team who would run the eviction. It also works as a tabletop for leadership: each decision has a business cost that someone has to accept.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.