Cyber Exercises

// Full spectrum coverage  ·  Updated 2026  ·  CMTA Cyber

Overview

Cyber exercises are structured activities designed to test, validate, and improve an organization's security capabilities. They range from low-stakes tabletop discussions to full-scale red vs. blue simulations and are essential for building organizational resilience before a real incident occurs.

This reference covers the full spectrum - from executive tabletop exercises and purple team engagements to CTF platforms for individual skill development and CISA-provided frameworks for government and critical infrastructure organizations.

Tabletop Exercises (TTX)

A tabletop exercise is a discussion-based session where team members walk through a simulated scenario to identify gaps in plans, policies, and communication. No live systems are involved - the goal is to test decision-making and coordination.

TTX Structure

Common TTX Scenarios

• Ransomware Attack - Critical systems encrypted, attacker demands payment, backups potentially compromised
• Business Email Compromise (BEC) - CFO email spoofed, fraudulent wire transfer initiated
• Insider Threat - Disgruntled employee exfiltrating customer data before resignation
• Supply Chain Compromise - Trusted vendor software update contains malicious code
• Data Breach Notification - PII exposed, regulatory notification timelines triggered
• DDoS Attack - Internet-facing services unavailable during peak business hours
• OT/ICS Disruption - Industrial control systems manipulated, safety concerns
• Third Party Breach - Cloud provider breached, your data potentially exposed

TTX Facilitation Tips

• Define objectives before selecting a scenario - not the other way around
• Include legal, communications, HR, and executive leadership - not just IT
• Assign a neutral facilitator who keeps discussion moving and challenges assumptions
• Use a dedicated notetaker to capture gaps and action items in real time
• Avoid "we would just..." answers - require specific, named decisions
• Time-box each inject to maintain urgency
• Conduct a hot wash immediately after while observations are fresh
• Produce an After Action Report (AAR) within two weeks

Purple Team Exercises

Purple team exercises bring red team (offensive) and blue team (defensive) together in a collaborative session to improve detection and response capabilities. Unlike adversarial red team engagements, purple team is transparent and cooperative.

Purple Team Methodology

MITRE ATT&CK Techniques to Start With

• T1059 - Command and Scripting Interpreter (PowerShell, Bash)
• T1078 - Valid Accounts (credential misuse)
• T1003 - OS Credential Dumping (Mimikatz)
• T1566 - Phishing (spearphishing attachment/link)
• T1055 - Process Injection
• T1190 - Exploit Public-Facing Application
• T1021 - Remote Services (RDP, SMB, WinRM)
• T1041 - Exfiltration Over C2 Channel

Open Source Purple Team Tools

# Atomic Red Team - MITRE ATT&CK mapped attack simulations
https://github.com/redcanaryco/atomic-red-team

# Caldera - automated adversary emulation platform
https://github.com/mitre/caldera

# VECTR - purple team tracking and reporting
https://github.com/SecurityRiskAdvisors/VECTR

# ATT&CK Navigator - visualize coverage
https://mitre-attack.github.io/attack-navigator/

# Stratus Red Team - cloud attack simulation
https://github.com/DataDog/stratus-red-team

Red Team Exercises

Red team exercises simulate a real adversary targeting your organization with a specific goal - access to a crown jewel system, exfiltration of sensitive data, or disruption of operations. Unlike penetration tests, red team engagements are goal-oriented and covert.

Red Team vs Penetration Test

Red Team Exercise Phases

• Reconnaissance - OSINT, passive recon, target profiling
• Initial Access - Phishing, external vulnerabilities, supply chain
• Execution & Persistence - Malware execution, backdoors, scheduled tasks
• Privilege Escalation - Local and domain privilege escalation
• Lateral Movement - Pass-the-hash, Kerberoasting, remote services
• Collection & Exfiltration - Data staging and exfiltration
• Objective Achievement - Crown jewel access, impact demonstration

CTF Resources

Capture The Flag competitions are gamified cybersecurity challenges where participants solve security puzzles to find hidden flags. Excellent for individual skill development across offensive and defensive domains.

CTF Categories

CTF Platforms

CTF Tips for Beginners

• Start with web and OSINT categories - lowest barrier to entry
• Read writeups after competitions end - they're the best learning resource
• Build a personal toolkit: CyberChef, Burp Suite Community, Python, GDB
• Join a team - CTFs are collaborative and you learn faster with others
• Don't skip forensics - it builds skills directly applicable to DFIR work
• Track your progress on CTFtime.org to benchmark against your peers

Practice Lab Platforms

Practice lab platforms provide legal, controlled environments to develop offensive and defensive security skills through guided learning paths, vulnerable machines, and real-world scenarios.

Recommended Learning Paths

Incident Response Simulations

IR simulations test your team's ability to detect, contain, eradicate, and recover from a real incident. Unlike tabletop exercises, IR simulations involve live systems, actual tools, and time pressure.

IR Simulation Scenario Templates

Scenario 1: Ransomware

• Trigger: EDR alert fires on a workstation - ransomware behavior detected
• Inject 1: 3 more workstations infected, encryption spreading
• Inject 2: File server offline, backups potentially compromised
• Inject 3: Ransom note discovered, attacker claims data exfiltration
• Objectives: Isolate, identify patient zero, assess backup integrity, notify leadership

Scenario 2: Phishing to Credential Theft

• Trigger: User reports suspicious email, clicked the link
• Inject 1: Credentials used from foreign IP address
• Inject 2: MFA bypass successful via adversary-in-the-middle
• Inject 3: Attacker accessing email and SharePoint
• Objectives: Reset credentials, revoke sessions, determine scope of access

Scenario 3: Insider Threat

• Trigger: DLP alert - large volume of files copied to USB
• Inject 1: Employee gave notice yesterday
• Inject 2: Files contain customer PII and IP
• Inject 3: Employee's access still active, traveling
• Objectives: Preserve evidence, revoke access, engage legal/HR, assess data exposure

IR Simulation Checklist

PRE-SIMULATION
[ ] Define objectives and success criteria
[ ] Select and brief the facilitator
[ ] Notify IT/security leadership (white cell)
[ ] Prepare injects and timeline
[ ] Set up out-of-band communication channel
[ ] Brief participants on rules of engagement

DURING SIMULATION
[ ] Record all actions taken with timestamps
[ ] Capture tool outputs and logs
[ ] Note communication delays and gaps
[ ] Track escalation decisions
[ ] Document assumptions made under pressure

POST-SIMULATION
[ ] Conduct immediate hot wash (30 min)
[ ] Collect participant feedback forms
[ ] Review timeline of actions vs expected
[ ] Identify detection gaps and tool failures
[ ] Document lessons learned
[ ] Assign remediation owners and deadlines
[ ] Schedule follow-up exercise to validate fixes

CISA Exercise Frameworks

The Cybersecurity and Infrastructure Security Agency (CISA) provides free exercise frameworks, scenario libraries, and facilitation guides primarily aimed at government and critical infrastructure organizations - but applicable to any organization.

CISA Exercise Programs

Cyber Range Concepts

A cyber range is a virtual environment that replicates real-world IT and OT infrastructure for training, testing, and exercise purposes. Ranges can be cloud-based, on-premises, or hybrid.

Open Source Cyber Range Tools

Home Lab Minimum Viable Setup

# Minimum hardware recommendation
RAM:    16GB (32GB preferred)
CPU:    4 cores (8 preferred)
Storage: 500GB SSD

# Core components
Hypervisor:     VirtualBox (free) or VMware Workstation
Attack Machine: Kali Linux or Parrot OS
Target:         Windows Server 2019 + Windows 10 client
Detection:      Security Onion or ELK Stack
AD Lab:         DetectionLab or GOAD

# Quick start with DetectionLab
git clone https://github.com/clong/DetectionLab
cd DetectionLab/Vagrant
vagrant up dc logger wef win10

Exercise Planning Guide

A structured approach to planning any cyber exercise - from tabletop to full simulation.

8-Week Exercise Planning Timeline

After Action Report (AAR) Template

AFTER ACTION REPORT
Exercise: [Name]
Date: [Date]
Classification: [Internal Use Only / Confidential]

1. EXECUTIVE SUMMARY
   Brief overview of exercise, key findings, and top recommendations.

2. EXERCISE OVERVIEW
   - Type: Tabletop / Functional / Full-Scale
   - Scenario: [Brief description]
   - Participants: [Teams/roles represented]
   - Objectives: [What we set out to test]

3. STRENGTHS OBSERVED
   - What worked well
   - Processes that functioned as designed
   - Strong individual/team performances

4. AREAS FOR IMPROVEMENT
   - Gaps identified in detection
   - Communication breakdowns
   - Missing playbooks or procedures
   - Tool/technology gaps

5. RECOMMENDATIONS
   Priority  | Recommendation         | Owner  | Due Date
   --------- | ---------------------- | ------ | --------
   Critical  | [Action item]          | [Name] | [Date]
   High      | [Action item]          | [Name] | [Date]
   Medium    | [Action item]          | [Name] | [Date]

6. NEXT EXERCISE
   Recommended date, type, and focus areas based on this AAR.