One-page tabletop scenario: "The Helpful Help Desk Call"

Free sample from Runbook Foundry · CC BY 4.0 · Run time: 45 to 60 minutes · Players: 4 to 8

Theme: a phone-based social engineering attack leads to a cloud account takeover and attempted payment fraud. No ransomware. Good as a first exercise for teams that rely on email and cloud apps.

Roles: Facilitator (reads injects, asks questions) · Scribe (writes down decisions, owners and gaps) · Players: owner/manager, IT or MSP contact, finance, office manager, whoever handles customers.

Ground rules (read aloud): no blame; answer with the tools and authority you have today; make a call and say why; don't fight the scenario.

Inject 1 (Tuesday, 10:05)

A caller claiming to be from "IT support" phones the office manager and says her mailbox is "about to be suspended". He talks her through approving a sign-in prompt on her phone. Afterwards she mentions it to a colleague, who thinks it sounds odd.

Who should she tell, and how quickly? Does everyone know who that is?
What does IT do in the first 15 minutes? (Think: reset password, revoke sessions, review MFA methods.)
How would we know whether the attacker registered their own MFA method?

Inject 2 (Tuesday, 11:30)

IT finds a new inbox rule on the account that moves any email containing "invoice" or "payment" to an obscure folder, plus a forwarding rule to an outside address.

What else should we check on this account? On other accounts?
Who decides whether to tell staff now, and what do we say?
Is anything about this logged? How far back do our logs go?

Inject 3 (Wednesday, 09:15)

A long-standing supplier calls finance to ask why you've asked them to send future invoices to a "new bank account". The request came from the office manager's real mailbox.

Have any outgoing payments or incoming customer payments been redirected? Who checks, and with which bank?
Who contacts the supplier and other customers? Using what channel?
Do we need to call our insurer, our bank's fraud team or legal counsel today?

Hot wash (10 minutes)

What worked well?
Where did we hesitate?
What did we need but not have?
Which decisions had no clear owner?
What is the one fix we want first?

Common findings to look for

[ ] No rule that staff never approve unexpected MFA prompts
[ ] No quick "suspected compromise" steps written down for IT
[ ] Outbound forwarding to external addresses allowed for everyone
[ ] No call-back rule for changes to bank details
[ ] Insurer and bank fraud numbers not stored somewhere offline

After-action: list 3 to 5 findings, one action each, with an owner and a due date. Check progress at 30 and 90 days.

Templates and guidance only, not legal advice. Drafted with AI assistance and reviewed for accuracy. Not affiliated with Microsoft or Google.