Ransomware incident response labs, the kill chain in order
Ransomware response expects a team that can place itself on the kill chain at any moment: recognize the phish and the command-and-control that followed, spot the setup work before encryption, work a fast-moving outbreak live from the EDR feed, and handle the data-theft side of a double-extortion demand alongside recovery.
This pathway is the ransomware arc end to end. Patient Zero covers initial access, Dry Run covers what an operator sets up before the payload, First Call is the live outbreak, Double Cross tests a ransom note's claims against the evidence, and Nightfall is the complete incident worked start to finish. All five are hard or expert; this is the path for a team that already knows the basics.
5 cases · ~11 h 51 min of lab time · Hard to Expert · a different variant for everyone · verified answer keys
The pathway, in order
5 cases, about 11 h 51 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
Patient Zero (Phishing to Malware to Command and Control)
Initial access: from an opened document to outbound traffic.
HARD~2 h 39 minUp to 25 questions -
02
Dry Run (Ransomware Precursor: Caught Mid-Setup)
Catch an operator's setup before encryption.
HARD~2 h 14 minUp to 20 questions -
03
First Call (Ransomware Before Coffee)
A fast-moving outbreak worked live from the EDR feed.
HARD~1 h 15 minUp to 20 questions -
04
Double Cross (Ransomware: Double Extortion)
Test a ransom note's claims against the evidence.
HARD~2 h 29 minUp to 25 questions -
05
Nightfall (Operation Nightfall)
Capstone: the full hospital incident, start to finish.
EXPERT~3 h 14 minUp to 35 questions
What this pathway covers
Who it's for
- Security teams and on-call rotations who want a structured ransomware drill series with verified answer keys.
- Instructors teaching the capstone weeks of an IR course who want one coherent arc instead of unrelated cases.
- Responders preparing for tabletop or live exercises who want hands-on reps against the EDR, SIEM and host evidence.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Incident Handling (GCIH)
The incident-handling kill chain from the responder's own tooling: detection and triage through containment to a full-arc capstone, mapped to MITRE ATT&CK.
10 cases · ~13 h 8 min · GIAC GCIH
SOC Analyst & Triage (CySA+)
The SOC analyst's daily queue: reading and triaging detections from EDR and SIEM, correlating entities, and escalating a real incident.
12 cases · ~13 h 12 min · CompTIA CySA+
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE. GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.