attack_simulation:
name: Ransomware Chain Validation
objective: ransomware_readiness
target: finance_department
techniques:
- T1566.001 # Spearphishing
- T1059.001 # PowerShell
- T1486 # Data Encrypted
- T1490 # Inhibit Recovery
validate:
- edr_detection: required
- siem_alert: required
- soar_response: optional