Capstone -- a ransomware incident from precursor to review

capstone · 240 min · Objective 3.3

Task

Run the full scenario the rest of this domain has been preparing for. Unguided: you stage it, you respond to it, and you produce the artefacts. Nothing in this capstone encrypts anything -- the incident is built entirely from the precursors, which is where a real one can still be won.

Steps

  1. Stage the precursors over several days: access, discovery, credential theft, lateral movement, defence tampering, shadow copy deletion, bulk collection and a large outbound transfer. Seal the notes.
  2. Live normally in the lab in between, so the evidence sits inside real background noise rather than alone.
  3. Respond when your own alerting catches it -- or, if it never does, when you decide to look, and record that fact as the most important finding in the whole capstone.
  4. Run the full lifecycle, declaring the incident explicitly and recording what that declaration changed.
  5. Handle the injects yourself: assume at one point that the attacker is still present after containment, and that your first backup choice is unavailable.
  6. Close the incident against written criteria -- eradication verified, monitoring clean for a stated period, credentials rotated -- not because the work became tiresome.
  7. Write all six artefacts, then score against the sealed notes.

Verify

grep -c "^" /tmp/timeline.tsv
awk -F'\t' '$2=="" || $5==""' /tmp/timeline.tsv | wc -l
sha256sum -c /tmp/evidence/manifest.sha256 2>&1 | grep -c "FAILED"
tar -tzf /tmp/collector-backup.tar.gz | wc -l
awk -F'\t' '$3==""' /tmp/pir-actions.tsv | wc -l
grep -ciE "no evidence of|cannot (be )?(determine|establish)|unable to confirm" /tmp/incident-report.md

A timeline with no row missing its source or confidence, no evidence failing its hash, a backup that lists, and no action without an owner. The last count is the one worth dwelling on: a report of an incident this size with zero honest statements of uncertainty has almost certainly overstated something, because nobody finishes a response knowing everything.

Notes

The capstone is passed on whether the report would survive being read by a regulator, a customer's lawyer and the colleague whose control failed. Write it for that audience and the rest follows.

The most valuable single output is step 3's honest answer: did your own detection catch this, or did you find it because you knew where to look? An organisation notified from outside had a detection gap, and that belongs in the review rather than being quietly absorbed.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.