RANSOMWAREINCIDENT ACTIVE
Ransomware Outbreak
03:15 AM. PagerDuty fires P1. EDR telemetry shows svchost_update.exe encrypting files at 400 MB/min across the finance VLAN. 8 workstations affected and rising. An employee reports their wallpaper changed to a ransom note demanding 45 BTC.
STEP 1/3
MITRE ATT&CK:T1486Data Encrypted for Impact
What is your first action?
About Incident Response Simulator
A ransomware alert just fired. What do you do first? Navigate real-world security incidents and make the right calls under pressure.
Difficulty: IntermediateTime: ~8 min
How it works
- You work through three incident scenarios, each with three decisions, for nine calls in total.
- A simulated damage counter rises every second while you think, and a wrong call can multiply the accumulated damage.
- Each decision shows feedback and the correct action; some wrong choices also show a consequence. Each step displays a MITRE ATT&CK technique.
- There are no lives. A final grade runs from SOC Analyst L1 up to Incident Commander based on how many calls you got right.
What you'll learn
- How to respond to a ransomware outbreak: isolate affected hosts first, then scope the blast radius before eradicating.
- Practicing containment, evidence preservation, breach scoping, and credential remediation through the scenario choices.
- Investigating insider data exfiltration using DLP alerts, SIEM access logs, and OAuth session records.
- Mapping attacker actions to MITRE ATT&CK techniques, such as T1486 for data encrypted for impact.
FAQ
Is it free and do I need an account?
Yes, it is free with no sign-in. The scenarios and decision logic run in your browser.
Who is it for?
Aspiring and junior SOC analysts, incident responders, and anyone preparing for blue team or security operations interviews.
Which scenarios does it cover?
Three: a ransomware outbreak, data exfiltration by a former employee, and a compromised admin account reducing audit log retention.