Lab Guide — Intrusion Walkthrough Table-Read
Facilitated tabletop · 45–60 minutes · No devices required
What this lab is
A facilitated, sanitised table-read of a targeted intrusion against a fictional principal, "Director M." Participants take roles and narrate the intrusion stage by stage, pausing at each to answer one leadership question. There is no live malware, no exploit code, and no production system involved. The goal is to make the persistent-threat lens visceral, not to teach tooling.
Setup
- Group size: 8–16, split into the roles below. Larger groups add observers who score the decisions.
- Materials: this guide, the kill-chain slide (Lesson 01, slide 11) projected, and a timer (use the slide timer or any clock).
- Facilitator: the instructor, who reads the narrator stages and holds the pace.
Roles
| Role | Played by | Responsibility |
|---|---|---|
| Director M (the principal) | 1 participant | Owns the targeted accounts, travel, and relationships |
| Executive Assistant | 1 participant | Holds calendar, inbox access, and travel arrangements |
| Head of IT / Security | 1–2 participants | Describes what their controls would and would not see at each stage |
| Adversary Narrator | Facilitator | Reads each stage of the intrusion aloud |
| Observers | Remainder | Score the cheapest missed intervention at each stage |
Scenario brief
Director M leads a sensitive function in a partner organisation. M is active on a professional networking site, speaks at conferences, and travels overseas quarterly. M's assistant manages the calendar and books travel. The organisation has endpoint antivirus, legacy one-time-code MFA on email, and passed an external audit eight months ago.
Running the table-read
The facilitator reads each stage. After each, stop and put the stage question to the table. Capture answers on a board. Do not rush to the "right" answer — the disagreement is the learning.
Stage 1 — Reconnaissance
The narrator describes how M's public bio, conference talk, and the assistant's visible "out of office" pattern are aggregated.
Question: Which single public fragment, if removed, would most degrade the adversary's picture? Who owns the decision to remove it?
Stage 2 — Resource development
A lookalike domain of a real conference is registered; a plausible "speaker logistics" email is drafted.
Question: What would have to be true for the assistant to catch the lookalike domain in the moment?
Stage 3 — Initial access
The assistant receives the lure and clicks; a convincing login page appears.
Question: Is this an assistant failure, a system failure, or a leadership failure? Defend your answer.
Stage 4 — Credential access
The assistant enters the password and the one-time code; the adversary relays both in real time and is now logged in as the assistant.
Question: Your MFA "worked" and you were still compromised. What does that tell you about the control you funded?
Stage 5 — Collection & exfiltration
M's mailbox, calendar, and contacts are quietly copied. IT's first signal arrives days later.
Question: Where in this chain was the cheapest place to have stopped it — and why is it almost never where teams look first?
Debrief (10 minutes)
- Observers report the cheapest missed intervention at each stage.
- Map every intervention to "behavioural" vs "technical." Note the balance.
- Name one decision from this table-read that belongs to a leader in the room, not to IT.
✓ Self-check: the table can articulate, in one sentence each, why antivirus was irrelevant here and why the highest-leverage control sat at Stage 1.