The cybersecurity team at Fantasmatic Systems held their bi-yearly tabletop breach exercise. This time the scenario simulated a malicious development dependency exfiltrating user access tokens from the accounting team. Cybersecurity engineer Laurence Sawyer arrived to the event thinking it was a different type of tabletop roleplaying game. He was dressed head to toe as an elf, calling himself Eljor. Ready to plunder dragons and fight dungeons, complete with plastic ear extensions and a children's bow and arrow set he purchased on Amazon.
Sawyer, who clearly misread the prep work, decided to roll with it (pun intended!). While the team was checking app logs and EDR traces, Eljor (Sawyer) believed the setup was a distraction and the exfiltation was happening somewhere else. He spent the morning wandering the environment in search of his natural enemy, the hacker. As a Ranger, he is a natural tracker and used his abilities to find the wayward DNS entries that exfiltrated data.
Following Eljor's lead, the team believed the hacker was still in the system. Networking tools showed data was still being exfiltrated. No changes were made to stop it because Eljor didn't want to alert the hacker. "To spring a trap, your prey must think all is well," he whispered from underneath his hood in the only dimly lit corner of the room. And then suddenly, the trail went cold.
The team lost all leads on the hacker's whereabouts. When all hope was lost, Eljor jumped down from a tree branch (that he brought from home for such an occasion), raised his bow, and fired at a server! The team was stunned in silence. Why would he do such a thing? Did his elven vision reveal what we could not see? Is that why we all rolled perception checks? And then suddenly, the team erupted in cheers as he rolled a natural 20! The DM Lead explained that Eljor's shot hit a WiFi Pineapple hiding inside the server. The arrow severed the device's antenna.
The tabletop was a success. The team successfully disabled the Pineapple device and was able to track down the owner by asking the legal department to take over the rest of the work. And due to these events, the next team building exercise will be held at the local archery range.