Noodle RAT Aerospace Engineering Espionage - Planning Guide

Noodle RAT Aerospace Engineering Espionage

Complete preparation guide for advanced fileless espionage scenario

This planning document provides comprehensive facilitation guidance for running the Noodle RAT Aerospace Engineering Espionage scenario, featuring sophisticated memory-resident surveillance malware, classified defense technology theft, and nation-state targeting of aerospace engineering with national security implications.

1. Quick Reference

Element	Details
Malmon	Noodle RAT (Psychic/Flying dual-type)
Difficulty Tier	Tier 3 (Expert)
Scenario Variant	APT: Defense Aerospace Contractor
Organizational Context	SkyTech Aerospace: 450 engineers, classified aircraft development, defense security clearances
Primary Stakes	Classified aircraft designs + National security + Defense contracts + Engineering secrets
Recommended Formats	Full Game / Advanced Challenge
Essential NPCs	Dr. Amanda Chen (Chief Engineer), Colonel Michael Rodriguez (Security Officer), Lisa Foster (Senior Aerospace Engineer)
Optional NPCs	Robert Kim (Defense Security Service Agent), Military Program Manager, Foreign Intelligence Analyst

Scenario Hook

SkyTech Aerospace is completing classified military aircraft designs for Friday delivery when engineers notice subtle system anomalies despite security scans finding no malicious files—advanced fileless malware operates entirely in memory, providing foreign adversaries invisible access to classified aerospace engineering.

Victory Condition

Team identifies sophisticated memory-resident surveillance through behavioral analysis, protects classified aircraft designs from continued espionage, coordinates defense security counterintelligence investigation, and ensures military delivery timeline while addressing nation-state technology theft.

2. Game Configuration Templates

Full Game Configuration (120-140 min)

Pre-Configured Settings:

Number of Rounds: 3 rounds
Actions per Player: 2 actions per round
Investigation Structure: Open with classification security checkpoints
Response Structure: Creative with defense security constraints
Team Size: 5-6 players (full role complement)
Success Mechanics: Dice/Cards with fileless detection modifiers
Evidence Type: Subtle behavioral indicators only
NPC Count: 4-5 (essential + 1-2 optional)
Badge Tracking: On

Time Breakdown:

Introduction & Roles: 10 min
Scenario Briefing: 10 min
Round 1 (Behavioral Anomaly Detection): 30 min
Round 2 (Memory Analysis & Attribution): 35 min
Round 3 (Classified Information Protection & Response): 30 min
Standard Debrief: 10 min
Advanced Discussion: 10 min

Advanced Challenge Configuration (150+ min)

Pre-Configured Settings:

Number of Rounds: 4 rounds
Success Mechanics: Complex (Classification Security Status + System Integrity tracking)
Attack Complexity: Multi-stage fileless operations with sophisticated concealment
NPC Count: 6+ with conflicting security priorities

Time Breakdown:

Introduction & Roles: 15 min
Scenario Briefing: 15 min
Round 1-3: 100 min total (behavioral detection, memory forensics, counterintelligence coordination)
Round 4: Long-term aerospace security and defense contractor protection
Extended Debrief: 20 min

3. Scenario Overview

Opening Presentation

“It’s Wednesday morning at SkyTech Aerospace. Chief Engineer Dr. Amanda Chen’s team is completing final classified aircraft designs for military delivery Friday. But something unusual is happening. Experienced engineers report their workstations ‘feel different’—subtle performance variations, brief network activity indicators, moments where systems seem to pause inexplicably.

When Security Officer Colonel Rodriguez orders comprehensive security scans, the results show nothing. No malicious files. No unusual processes. No malware signatures. Clean systems according to every detection tool.

But Senior Aerospace Engineer Lisa Foster insists something is wrong. Files have accessed timestamps that don’t match her workflow. Network logs show data transfers she doesn’t remember initiating. Her engineering workstation feels like someone else has been using it.

Your incident response team faces a sophisticated challenge: How do you investigate a threat that leaves no files, no obvious processes, and evades every traditional security tool? And if foreign adversaries have invisible access to classified military aircraft designs, what does that mean for national security?“

Initial Symptoms

Engineering workstations showing subtle performance anomalies (brief delays, unexpected network activity) despite comprehensive security scans finding no malicious files or processes
File access timestamps on classified aircraft designs inconsistent with engineer workflows and documented work activities
Network monitoring detecting occasional unusual data transfers that engineers don’t recall initiating
Memory usage patterns showing slight variations from baseline that automated tools classify as “normal” but experienced engineers find “off”
Classified design files showing access patterns suggesting invisible surveillance rather than legitimate engineering work

Organizational Context

Organization Profile:

Name: SkyTech Aerospace (defense aerospace contractor)
Type: Defense Industrial Base - Classified Aircraft Development
Size: 450 engineers, DoD SECRET/TOP SECRET clearances, military program contracts
Key Assets: Classified aircraft designs, defense technology innovations, engineering methodologies, military contract deliverables
Regulatory Environment: NISPOM security requirements, CMMC compliance, DoD cybersecurity standards, counterintelligence protocols

Cultural Factors:

Defense security culture creates absolute classification protection requirements and counterintelligence awareness
Engineering excellence tradition means staff trust their technical instincts about system behavior anomalies
Military delivery commitments create intense timeline pressure balanced against security requirements
Classified program restrictions limit investigation tools and external consultation options

Malmon Characteristics

Noodle RAT manifests as sophisticated fileless malware operating entirely in memory without writing to disk, using PowerShell or WMI for execution, maintaining persistence through registry modifications and legitimate system tools, and providing invisible surveillance of classified aerospace engineering through memory-resident operations that evade file-based detection.

Key Capabilities:

Fileless Operation: Executes entirely in memory using PowerShell, WMI, or legitimate system binaries, leaving no malicious files for traditional antivirus detection
Memory-Resident Surveillance: Captures keystrokes, screenshots, and file access from memory without disk artifacts, providing invisible classified information theft
Legitimate Tool Abuse: Leverages Windows built-in administration tools (PowerShell, WMI, Task Scheduler) making malicious activity appear as normal system operations

Vulnerabilities:

Behavioral Patterns: While fileless, memory operations create detectable behavioral patterns in system resource usage, network communications, and process relationships
Memory Forensics: Advanced memory dump analysis can detect malicious code resident in RAM even when no file artifacts exist

4. NPC Reference

Essential NPCs

Dr. Amanda Chen (Chief Engineer)

Position: Leading classified aircraft development program
Personality: Technical excellence focused, security-conscious, protective of engineering team and classified designs
Agenda: Complete military delivery on schedule while ensuring classified information protection
Knowledge: Aircraft design details, engineering workflows, team member activities, classification requirements
Pressure Point: Professional reputation and military contract tied to delivery; security clearance depends on classified protection
IM Portrayal: Use Amanda to emphasize engineering expertise detecting anomalies automated systems miss

Colonel Michael Rodriguez (Security Officer)

Position: Facility security officer, DoD cleared, responsible for classified information protection
Personality: Security-first mindset, counterintelligence aware, methodical investigator
Agenda: Identify and eliminate threat to classified systems; coordinate defense security agencies if foreign espionage confirmed
Knowledge: Security protocols, classification handling, counterintelligence procedures, defense security service coordination
Pressure Point: Career responsibility for preventing classified information compromise
IM Portrayal: Introduces defense security requirements and counterintelligence coordination

Lisa Foster (Senior Aerospace Engineer)

Position: Principal engineer on classified aircraft design systems
Personality: Detail-oriented, trusts technical instincts, concerned about invisible surveillance
Agenda: Protect her engineering work and classified designs from apparent surveillance
Knowledge: Deep technical understanding of system behavior, file access patterns, engineering workflows
Pressure Point: Personal responsibility for classified information on her workstation
IM Portrayal: Technical detective who noticed subtle anomalies through expertise

Optional NPCs

Robert Kim (Defense Security Service Agent)

Position: DSS counterintelligence investigator for defense industrial base
Personality: Strategic investigator, concerned about nation-state technology targeting
Agenda: Attribution analysis and broader defense contractor protection
Knowledge: Foreign intelligence tradecraft, aerospace technology targeting patterns

5. Investigation Timeline

Round 1: Discovery Phase

Automatic Reveals:

Behavioral Anomalies: Engineers report subtle system performance variations despite security scans showing “clean”
File Access Discrepancies: Classified aircraft design files show access timestamps inconsistent with documented engineering work

Detective Investigation Leads:

Memory dump analysis reveals PowerShell code resident in RAM with classified file access capabilities
Timeline forensics show file access patterns suggesting systematic surveillance during off-hours
Behavioral analysis identifies malicious PowerShell execution using WMI for fileless persistence

Protector System Analysis:

Memory forensics detect unauthorized code execution in legitimate system processes
Network monitoring reveals data exfiltration disguised as normal administrative traffic
Classification security assessment shows potential compromise of SECRET/TOP SECRET aircraft designs

Tracker Network Investigation:

Network traffic analysis identifies covert data exfiltration channels using encrypted administrative protocols
Command and control investigation reveals sophisticated nation-state operational security
Attribution indicators point to foreign intelligence aerospace technology targeting

Communicator Stakeholder Insights:

Engineers describe spear-phishing emails with defense industry content that seemed legitimate
Security staff explain fileless malware challenges: “No files means traditional detection fails”
Defense security emphasizes counterintelligence: “Foreign intelligence targeting of classified programs”

Crisis Manager Coordination:

Military delivery deadline: 48 hours until classified aircraft design submission
Scope assessment: Multiple engineering workstations potentially compromised
Defense security notification requirements if foreign espionage confirmed

Threat Hunter Findings:

Memory-resident malware indicates nation-state sophistication and aerospace targeting specialization
Similar fileless techniques observed in intelligence reports of defense contractor espionage
Strategic assessment suggests classified technology acquisition for foreign military advantage

Round 2-3: Investigation & Response Phases

[Condensed for space - includes deep memory forensics, attribution to nation-state aerospace espionage programs, classified information damage assessment, defense security coordination, and military delivery decision]

6. Response Options

Most Effective (Psychic/Behavioral Strength):

Memory Forensics with Behavioral Analysis: Advanced RAM dump examination detects fileless malware through code analysis and behavioral patterns (DC 13)
PowerShell Logging Enhanced Detection: Enable comprehensive PowerShell script logging to detect fileless execution (DC 14)

Moderately Effective:

System Rebuild from Clean Images: Complete workstation rebuild eliminates memory-resident threats but time-intensive (DC 12, extended timeline)
Network Behavioral Monitoring: Detect exfiltration through traffic pattern analysis (DC 15)

Least Effective (Flying Resistance):

File-Based Antivirus Scanning: Fileless malware has no files to detect (DC 22, very low success)
Signature-Based Detection: No static signatures for memory-only operations (Automatic failure)

7-12. [Additional Sections]

[Facilitator Guide, Pacing Notes, Debrief Points, Quick Reference, Customization, Cross-References - structured similarly to Stuxnet documents but condensed for space efficiency]

Key Learning Objectives:

Understanding fileless malware detection requiring behavioral analysis beyond signature-based tools
Classified information protection in aerospace defense environments
Nation-state aerospace technology espionage tradecraft
Memory forensics and advanced threat hunting techniques
Defense industrial base security coordination

MITRE ATT&CK Techniques:

T1059.001 (PowerShell) - Fileless execution
T1055 (Process Injection) - Memory-resident operations
T1047 (WMI) - Legitimate tool abuse
T1005 (Data from Local System) - Classified information theft

Notes for IM Customization

What worked well:

What to modify next time:

Creative player solutions:

Timing adjustments: