The technical answer is only half of it. Practice the other half.

Unwrap this breach's own artifacts: the appliance exploit request, the encoded scheduled task on the file server and the exfil manifest. The destination host you recover is what the customer notification names. Open it at: Windows desktop → Forge Chef (launches the graded campaign).

Leads: CISO · Done when: Findings are posted to the room in time to answer "Infrastructure wants to reimage the appliance tonight. Evidence first?".

Investigate the file server the scheduled task landed on: detonate the sample in isolation, image the disk and carve the artifacts that prove what ran before the rebuild. Open it at: Windows desktop → Start menu → DFIR Artifact Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Infrastructure wants to reimage the appliance tonight. Evidence first?".

Image the appliance with dd, walk the partitions with mmls/fls and carve deleted files with foremost before anyone rebuilds it. Open it at: Linux desktop → Start menu → DFIR Tools Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Infrastructure wants to reimage the appliance tonight. Evidence first?".

Pulling it offline drops every remote depot and third-party integration. Leaving it up leaves the intruder a front door.

Leads: CISO · Done when: CISO picks one of 3 options before 01:00. Letting it lapse is scored as a choice.

The appliance holds the only record of what came in and out. A vendor factory reset destroys it.

Leads: CISO · Done when: CISO picks one of 3 options before 01:40. Letting it lapse is scored as a choice.

Contain the exfil path at the network edge: add the drop rule for the upload destination, prove it blocks with a test connection, and leave legitimate traffic untouched. Open it at: Windows desktop → Start menu → Firewall Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Three footholds are confirmed. How far does the rebuild go?".

Find and grade every foothold the intruder left: cron entries, systemd timers, rogue accounts and loaded modules. The count you report drives the rebuild scope. Open it at: Linux desktop → Start menu → Persistence Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Three footholds are confirmed. How far does the rebuild go?".

Prove Network Level Authentication is enforced on the file server: show where a non-NLA client and a wrong password each fail. Open it at: Windows desktop → Start menu → Remote Desktop Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Three footholds are confirmed. How far does the rebuild go?".

Read the SMB session to the file server off the wire: port, retransmissions, the real scaled window and who closed the connection. Open it at: Windows or Linux desktop → Start menu → TCP Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Three footholds are confirmed. How far does the rebuild go?".

The appliance image has to exist before infrastructure resets the device.

Leads: CISO · Done when: A decision that satisfies it is made before 01:40.

The responders' foothold count from the Persistence lab is the input here: cron, timer, rogue sudo account — and possibly more not yet found.

Leads: Operations · Done when: Operations picks one of 3 options before 02:25. Letting it lapse is scored as a choice.

Contract requires notice of a security incident affecting their data within 24 hours of becoming aware.

Leads: General Counsel · Done when: General Counsel picks one of 3 options before 02:40. Letting it lapse is scored as a choice.

Modeled as the exercise window; the clause starts at the exfiltration finding.

Leads: General Counsel · Done when: A decision that satisfies it is made before 02:40.

Names, addresses and license numbers for roughly 3,100 drivers. Awareness began with the confirmed exfiltration finding.

Leads: Privacy Officer · Done when: Privacy Officer picks one of 3 options before 03:35. Letting it lapse is scored as a choice.

Drivers, customers and staff will all read the same story.

Leads: Communications · Done when: Communications picks one of 3 options before 04:10. Letting it lapse is scored as a choice.

Personal data in scope means the privacy clock is running.

Leads: Privacy Officer · Done when: A decision that satisfies it is made before 03:35.

Unwrap the four artifacts from this intrusion: the macro loader URL, the encoded beacon launcher, the ransom-note contact block and the ransomware mutex. The C2 and the victim id you recover are what the negotiation and notification calls rest on. Open it at: Windows desktop → Forge Chef (launches the graded campaign).

Leads: CISO · Done when: Findings are posted to the room in time to answer "The press has the ransom note. What do you say?".

Find every foothold left behind — cron, timers, accounts, modules — so the restore does not put the intruder back with the data. Open it at: Linux desktop → Start menu → Persistence Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "The press has the ransom note. What do you say?".

Drop the seeded payload with the framework, then take the artifact into Forge Triage: report the SHA-256 and imphash, the rule that fires on the build marker, the C2 URL and the Run-key, and the injected region in the memory slice. Those indicators are what the containment sweep is written from. Open it at: Windows desktop → Metasploit in the terminal, then Forge Triage (launches the graded campaign).

Leads: CISO · Done when: Findings are posted to the room in time to answer "The press has the ransom note. What do you say?".

Emergency care is running on paper. Elective imaging is unavailable.

Leads: Operations · Done when: Operations picks one of 3 options before 00:45. Letting it lapse is scored as a choice.

Forensics has not yet confirmed exfiltration. The reporter publishes at noon.

Leads: Communications · Done when: Communications picks one of 3 options before 01:20. Letting it lapse is scored as a choice.

Say something accurate before someone else defines it for you.

Leads: Communications · Done when: A decision that satisfies it is made before 01:20.

Image an encrypted clinical file server, walk the partitions and carve the deleted staging directory to prove what was taken before it was locked. Open it at: Linux desktop → Start menu → DFIR Tools Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "Exfiltration of personal data is confirmed. Notify?".

The clock on notifying the authority runs from the moment you became aware.

Leads: Privacy Officer · Done when: Privacy Officer picks one of 3 options before 02:50. Letting it lapse is scored as a choice.

Backups for imaging are 14 hours old and restorable. The archive copy is intact. Legal has flagged sanctions screening.

Leads: Chief Executive · Done when: Chief Executive picks one of 3 options before 03:20. Letting it lapse is scored as a choice.

Within 72 hours of awareness — modeled here as the exercise window.

Leads: Privacy Officer · Done when: A decision that satisfies it is made before 02:50.

The initial access vector is a stolen VPN credential without MFA. It has not yet been closed.

Leads: CISO · Done when: CISO picks one of 2 options before 03:55. Letting it lapse is scored as a choice.

Sweep for the accounts, keys, timers and sudo rules a privileged leaver could keep after their badge stops working. Open it at: Linux desktop → Start menu → Persistence Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "He is still employed and still has privileged access. What do you do with it?".

Cutting access tips him off and may prejudice an employment process. Leaving it lets him keep working — and keep copying.

Leads: CISO · Done when: CISO picks one of 3 options before 01:10. Letting it lapse is scored as a choice.

Stage, load and then detect the hiding module on the research host: compare /proc/modules against sysfs, read the taint flags and the kernel ring buffer, then unload it — after the image is taken. Open it at: Linux desktop → Start menu → Kernel Module Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "The hiding module is loaded on a production research host. Remove it now?".

Reproduce how the leaver kept root on the research host — the writable unit behind a sudo rule — then close the hole and restart the service so the fix is proven. Open it at: Linux desktop → Start menu → Privilege Escalation.

Leads: CISO · Done when: Findings are posted to the room in time to answer "The hiding module is loaded on a production research host. Remove it now?".

He is rostered on-call tonight with full cluster rights.

Leads: CISO · Done when: A decision that satisfies it is made before 01:10.

Unloading restores visibility but changes the host. Volatile state is the proof that it was hiding anything.

Leads: CISO · Done when: CISO picks one of 3 options before 02:00. Letting it lapse is scored as a choice.

Unwrap the masked dmesg line, the leaver's bastion transcript and the sudoers grant behind them. The bucket the assay data landed in is what the partner-contract call turns on. Open it at: Windows desktop → Forge Chef (launches the graded campaign).

Leads: CISO · Done when: Findings are posted to the room in time to answer "How do you pursue the data itself?".

Image the administrator's workstation and the research host, then carve deleted archives to establish what left and when. Open it at: Linux desktop → Start menu → DFIR Tools Lab.

Leads: CISO · Done when: Findings are posted to the room in time to answer "How do you pursue the data itself?".

Memory and module state disappear on the next reboot.

Leads: CISO · Done when: A decision that satisfies it is made before 02:00.

41 GB on removable media, a named future employer and an employee still inside his notice period.

Leads: General Counsel · Done when: General Counsel picks one of 3 options before 02:45. Letting it lapse is scored as a choice.

Rotation needs a maintenance window across the research cluster mid-program.

Leads: Operations · Done when: Operations picks one of 3 options before 03:30. Letting it lapse is scored as a choice.

Jointly owned assay data, milestone payments and an audit right in the agreement.

Leads: General Counsel · Done when: General Counsel picks one of 3 options before 04:05. Letting it lapse is scored as a choice.

Jointly owned data means the alliance agreement clock runs too.

Leads: General Counsel · Done when: A decision that satisfies it is made before 04:05.

Naming an individual before any finding creates its own liability. Saying nothing invites the worst reading.

Leads: Communications · Done when: Communications picks one of 3 options before 04:45. Letting it lapse is scored as a choice.

Decode the provider advisory, the SFTP export log and the actor's sample schema. The column names you recover decide whether this is notifiable and who the controller is. Open it at: Windows desktop → Forge Chef (launches the graded campaign).

Leads: CISO · Done when: Findings are posted to the room in time to answer "The provider will not confirm scope. What do you do first?".

You have no visibility into their environment and no confirmed impact on your data.

Leads: CISO · Done when: CISO picks one of 3 options before 00:55. Letting it lapse is scored as a choice.

The works council is asking, and the sample includes real Meridian rows.

Leads: Communications · Done when: Communications picks one of 2 options before 02:00. Letting it lapse is scored as a choice.

High risk to individuals means telling them, not just the regulator.

Leads: Communications · Done when: A decision that satisfies it is made before 02:00.

Scope is partial: you know the sample is real, you do not know the full record count.

Leads: Privacy Officer · Done when: Privacy Officer picks one of 2 options before 02:45. Letting it lapse is scored as a choice.

Bank details in the platform may have been altered as well as read.

Leads: Chief Financial Officer · Done when: Chief Financial Officer picks one of 2 options before 02:55. Letting it lapse is scored as a choice.

The duty is yours regardless of whose systems failed.

Leads: Privacy Officer · Done when: A decision that satisfies it is made before 02:45.

The clock starts at determination, and 'we never got round to determining' is itself a finding.

Leads: General Counsel · Done when: General Counsel picks one of 3 options before 01:10. Letting it lapse is scored as a choice.

The filing clock starts here, so the determination itself must be prompt.

Leads: General Counsel · Done when: A decision that satisfies it is made before 01:10.

Selective disclosure to one analyst is its own violation.

Leads: Communications · Done when: Communications picks one of 2 options before 01:55. Letting it lapse is scored as a choice.

Decode the query the intruder ran, the RMM launcher and the persistence service. What data was actually read is the evidence behind the materiality determination. Open it at: Windows desktop → Forge Chef (launches the graded campaign).

Leads: CISO · Done when: Findings are posted to the room in time to answer "Forensics says client transaction volumes were queried. Material?".

No financial loss, no manipulation — but competitively sensitive client data and an 11-day dwell time.

Leads: Chief Financial Officer · Done when: Chief Financial Officer picks one of 3 options before 03:00. Letting it lapse is scored as a choice.

Four business days from determination, modeled as the exercise window.

Leads: Chief Financial Officer · Done when: A decision that satisfies it is made before 03:00.

Everything written is discoverable. Employees are reading the wire story.

Leads: Chief Executive · Done when: Chief Executive picks one of 2 options before 03:15. Letting it lapse is scored as a choice.

Supplied fictional clause: decide and route notice once a data impact is reasonably suspected.

Leads: Communications · Done when: A decision that satisfies it is made before 00:30.

Unwrap this breach's own artifacts: the appliance exploit request, the encoded scheduled task on the file server and the exfil manifest. The destination host you recover is what the customer notification names. Open it at: Windows desktop → Forge Chef (launches the graded campaign).

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

Investigate the file server the scheduled task landed on: detonate the sample in isolation, image the disk and carve the artifacts that prove what ran before the rebuild. Open it at: Windows desktop → Start menu → DFIR Artifact Lab.

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

Image the appliance with dd, walk the partitions with mmls/fls and carve deleted files with foremost before anyone rebuilds it. Open it at: Linux desktop → Start menu → DFIR Tools Lab.

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

Contain the exfil path at the network edge: add the drop rule for the upload destination, prove it blocks with a test connection, and leave legitimate traffic untouched. Open it at: Windows desktop → Start menu → Firewall Lab.

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

Find and grade every foothold the intruder left: cron entries, systemd timers, rogue accounts and loaded modules. The count you report drives the rebuild scope. Open it at: Linux desktop → Start menu → Persistence Lab.

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

Prove Network Level Authentication is enforced on the file server: show where a non-NLA client and a wrong password each fail. Open it at: Windows desktop → Start menu → Remote Desktop Lab.

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

Work Meridian's own network: confirm the gateway bypass and web shell, follow the service account to the domain controller and file server, state your confidence about the manifests archive, and name the restore point that is safe to recover from. Open it at: Windows analyst desk MF-SOC-01 → SIEM (launches the graded lab).

Leads: CISO · Done when: Findings are posted to the room in time to answer "Remote access may be actively abused. Taking the whole gateway offline will disrupt dispatch. What do you authorize, on what evidence, and what would change your mind?".

Read the SMB session to the file server off the wire: port, retransmissions, the real scaled window and who closed the connection. Open it at: Windows or Linux desktop → Start menu → TCP Lab.

Leads: CISO · Done when: The lab is graded and its findings are posted to the room.

You have an advisory, a suspicious event and a dependency on the gateway. Little is confirmed.

Leads: Chief Executive · Done when: Chief Executive picks one of 3 options before 00:10. Letting it lapse is scored as a choice.

Options from I04. Preservation status depends on your first call.

Leads: Chief Executive · Done when: Chief Executive picks one of 3 options before 00:15. Letting it lapse is scored as a choice.

Rebuilding the gateway fast restores confidence; it also destroys what the image hasn't captured.

Leads: CISO · Done when: CISO picks one of 2 options before 00:24. Letting it lapse is scored as a choice.

The screenshot is unverified. Staging is moderate-confidence; transfer is low-confidence.

Leads: Communications · Done when: Communications picks one of 3 options before 00:29. Letting it lapse is scored as a choice.

One recovery point passes checks; others aren't validated. The service owner hasn't accepted anything yet.

Leads: Operations · Done when: Operations picks one of 3 options before 00:35. Letting it lapse is scored as a choice.