Tabletop anyone?

I'm looking for a basic tabletop scenario for our internal team, we have an IRP and several security systems that would be alerted. What I'm thinking is some phishing situation that allowed a users credentials to be harvested including the session OTP for 365 email. I don't fully have the scenario built and hope some of you can help me fill in some blanks.

Thanks

basic can credentials cybersecurity don email hope internal irp otp phishing scenario security session systems tabletop team thinking