Preparation Checklist – Winnti: Biotech R&D Espionage (Large Group)

Days Before: Print & Cut

• This checklist – preparation-checklist.html
• Artifact cards – organizational-context.html (cut to card size; 21 cards across 12 envelopes)
• IC Cards – ic-handover-cards.html, 2 pages A4 portrait, cut in half (= 4 half-cards)
• IC Decision Packet – ic-decision-packet.html, 4 pages A4 portrait (one per round)
• Facilitator Session Checklist – facilitator-cheat-sheet.html, print double-sided
• Debrief Tracker – debrief-tracker.html, 1 page A4
• Action Resolution Card – action-resolution-card.html, laminate if possible
• Threat Clock Cards – threat-clock-cards.html, 5 cards
• Pre-Built Action Cards – action-cards.html, 3 cards
• NPC Reference Sheets – npc-reference-sheets.html, 5 pages (one per NPC)
• Bonus Inject Cards – bonus-inject-cards.html, 5 cards (optional – bring anyway)
• Position cards – position-cards.html, 4 sheets A4 landscape (Alpha + Alpha Lead, Bravo + Bravo Lead, Charlie + Charlie Lead, IC + spare)

Night Before: Assemble Envelopes

Label 12 envelopes. Place cards inside, seal. Stack each team’s envelopes in round order (R1 on top).

Alpha – Forensics

• R1 (2 cards): A-R1-1 HANSEN-SAP-01 System Profile · A-R1-2 Azure AD Sign-In Anomaly
• R2 (3 cards): A-R2-1 Memory Forensics Output · A-R2-2 Supply Chain Delivery Analysis · A-R2-3 Pass-the-Hash Forensics
• R3 (1 card): A-R3-1 Kernel Driver Activity Timeline Gap
• R4 (2 cards): A-R4-1 Rootkit Capability Analysis · A-R4-2 Lateral Movement Scope Expansion

Bravo – Network / Infrastructure

• R1 (2 cards): B-R1-1 Collaborative Bridge VPN Log · B-R1-2 HANSEN-SAP-01 Outbound Traffic Log
• R2 (3 cards): B-R2-1 Collaborative Bridge VPN Full History · B-R2-2 Azure CA Bypass Detail · B-R2-3 Legacy Auth Exception Policy Record
• R3 (1 card): B-R3-1 Historical NetFlow Baseline Comparison
• R4 (2 cards): B-R4-1 Outbound HTTPS Traffic Analysis · B-R4-2 DLP Configuration & Alert Log

Charlie – Threat Intel & Recovery

• R1 (2 cards): C-R1-1 CFCS Tip-Off Advisory · C-R1-2 TI Platform Enrichment
• R2 (3 cards): C-R2-1 GenixLibrary Access Log · C-R2-2 C2 Infrastructure Deep Enrichment · C-R2-3 CFCS Cross-Victim Campaign Data
• R3 (1 card): C-R3-1 C2 Infrastructure Rotation Alert
• R4 (2 cards): C-R4-1 CFCS Victim A Recovery Debrief · C-R4-2 CFCS Forensic Comparison Results

Facilitator Stack (keep loose)

• IC Cards – all 4 half-pages
• Facilitator Session Checklist
• Debrief Tracker
• Action Resolution Card
• Threat Clock Cards T1–T5 (T1 on top)
• Pre-Built Action Cards (3 cards)
• NPC Reference Sheets (5 pages)
• Bonus Inject Cards (5 cards, hold back)
• d20 die

Day Of: Room Setup

• Whiteboard: two columns – OPEN and CONTAINED – with space for system and credential names
• Team tables: place position card and R1 envelope at each table (do not open)
• IC positions: IC #1 position card at facilitator table; IC #2 position card at separate chair near exit
• Facilitator table: stack, d20, timer
• Sticky notes and pens at each table
• Notepads and pens for IC #1 and IC #2 (for notes during team briefings)
• Timer ready and visible

T−10 min: Pre-Game

• Hand IC Cards page 1 to both ICs
• Verbal brief to IC #1: roll points, handover timing (~T+70), whiteboard format
• Verbal brief to IC #2: will be called back in at ~T+70; no scenario details
• Send IC #2 out of the room
• Confirm all R1 envelopes at tables, unopened
• Confirm whiteboard is blank and labeled