Project 78: Ransomware Response Simulation

Module: Module 8: Exploit Development & Malware Fundamentals  |  Level: Advanced  | 
Primary tool: LetsDefend free-tier ransomware scenario  |  Estimated time: 2–4 hours

Objective: Run the full incident-response lifecycle (detect, contain, eradicate, recover) against a simulated case.

Free lab environment

LetsDefend incident-response simulations (free tier) — https://letsdefend.io/

LetsDefend’s free tier includes guided, sanitized incident scenarios (phishing, ransomware, C2 beaconing) with real alert data, so you can practice the full detection-to-recovery workflow without a live incident.

Lab workflow

1. Open the scenario in LetsDefend’s free-tier ransomware scenario and read the full incident context before taking any action.
2. Work the lifecycle in order — detect, contain, eradicate, recover — resisting the urge to jump straight to remediation before you’ve confirmed scope.
3. For the containment decision specifically, write out the evidence that justified run the full incident-response lifecycle (detect, contain, eradicate, recover) against a simulated case at that exact point in the timeline.
4. Build a timeline table: timestamp, event, evidence source, your action.
5. Write your final recovery note: what you’d verify before considering the incident closed.
6. Compare your decisions against the platform’s model answer, if provided, and note any gap.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your completed incident timeline for the simulation
• your written containment decision and the evidence that justified it

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.