Transfer of funds

mukul975/Anthropic-Cybersecurity-SkillsSecurityAudit failedSnapshot 9a7d1f5f8789

Installs: 0

Summary

Builds a structured SOC incident response playbook for ransomware attacks

SKILL.md

Building SOC Playbook for Ransomware

When to Use

Use this skill when:

SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts
An organization lacks documented procedures for ransomware containment and recovery
Tabletop exercises reveal gaps in ransomware response coordination
Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks

Do not use during an active ransomware incident as the sole guide — have pre-built playbooks tested and rehearsed before incidents occur.

Prerequisites

SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data
EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability
Backup infrastructure with tested recovery procedures and offline/immutable backups
Communication plan with legal, executive leadership, and external IR retainer contacts
MITRE ATT&CK knowledge for ransomware technique chains

Workflow

Step 1: Define Detection Triggers

Create SIEM detection rules for early ransomware indicators:

Mass File Encryption Detection (Splunk):

index=sysmon EventCode=11
| bin _time span=1m
| stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time
| where unique_files > 100
| eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO")
| where suspicious_extensions="YES" OR unique_files > 500
| sort - unique_files

Shadow Copy Deletion (T1490):

index=wineventlog sourcetype="WinEventLog:Security" OR index=sysmon EventCode=1
(CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*"
 OR CommandLine="*bcdedit*/set*recoveryenabled*no*" OR CommandLine="*wbadmin*delete*catalog*")
| table _time, Computer, User, ParentImage, Image, CommandLine

index=sysmon EventCode=11
TargetFilename IN ("*README*.txt", "*DECRYPT*.txt", "*RANSOM*.txt", "*RECOVER*.html", "*HOW_TO*.txt")
| stats count by Computer, Image, TargetFilename
| where count > 5

sequence by host.name with maxspan=2m
  [process where event.type == "start" and
    process.args : ("*vssadmin*", "*delete*", "*shadows*")]
  [file where event.type == "creation" and
    file.name : ("*README*DECRYPT*", "*RANSOM*", "*HOW_TO_RECOVER*")]

RANSOMWARE ALERT TRIAGE
│
├── Is encryption actively occurring?
│   ├── YES → IMMEDIATE: Isolate host from network (Step 3)
│   │         Do NOT power off (preserve memory for forensics)
│   └── NO → Is this a pre-encryption indicator?
│       ├── Shadow copy deletion → HIGH PRIORITY: Isolate and investigate
│       ├── Known ransomware hash → HIGH PRIORITY: Block hash, scan enterprise
│       └── Suspicious process behavior → MEDIUM: Investigate, prepare isolation
│
├── How many hosts affected?
│   ├── Single host → Contained incident, follow host isolation procedure
│   ├── Multiple hosts (2-10) → Escalate to Tier 2, begin enterprise-wide scan
│   └── Enterprise-wide (>10) → Activate full IR team, engage external retainer
│
└── Is data exfiltration confirmed?
    ├── YES → Double extortion scenario, engage legal for breach notification
    └── NO/UNKNOWN → Check for Cobalt Strike/C2 beacons, review outbound transfers

# Isolate host using CrowdStrike Falcon API
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["device_id_here"]}'

# Isolate machine via MDE API
$headers = @{Authorization = "Bearer $token"}
$body = @{Comment = "Ransomware containment - IR-2024-0500"; IsolationType = "Full"} | ConvertTo-Json
Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" `
    -Method Post -Headers $headers -Body $body -ContentType "application/json"

# Palo Alto — Block SMB lateral spread
set rulebase security rules RansomwareContainment from Trust to Trust
set rulebase security rules RansomwareContainment application ms-ds-smb
set rulebase security rules RansomwareContainment action deny
set rulebase security rules RansomwareContainment disabled no
commit

# Disable compromised account
Disable-ADAccount -Identity "compromised_user"

# Reset Kerberos TGT (if domain admin compromised)
# WARNING: This resets krbtgt and requires two resets 12+ hours apart
Reset-KrbtgtKeys -Server "DC-PRIMARY" -Force

# Block lateral movement by disabling remote services
Set-Service -Name "RemoteRegistry" -StartupType Disabled -Status Stopped

# Capture running processes and network connections
Get-Process | Export-Csv "C:\IR\processes_$(hostname).csv"
Get-NetTCPConnection | Export-Csv "C:\IR\netstat_$(hostname).csv"

# Capture memory dump (if host still running)
winpmem_mini_x64.exe C:\IR\memory_$(hostname).raw

# Collect ransomware artifacts
Copy-Item "C:\Users\*\Desktop\*README*" "C:\IR\ransom_notes\" -Recurse
Copy-Item "C:\Users\*\Desktop\*.encrypted" "C:\IR\encrypted_samples\" -Force

# Capture event logs
wevtutil epl Security "C:\IR\Security_$(hostname).evtx"
wevtutil epl System "C:\IR\System_$(hostname).evtx"
wevtutil epl "Microsoft-Windows-Sysmon/Operational" "C:\IR\Sysmon_$(hostname).evtx"

index=sysmon (EventCode=1 OR EventCode=11 OR EventCode=3)
(TargetFilename="*ransomware_binary_name*" OR sha256="KNOWN_HASH"
 OR DestinationIp="C2_IP_ADDRESS" OR CommandLine="*malicious_command*")
| stats count by Computer, EventCode, Image, CommandLine
| sort - count

POST-INCIDENT REVIEW TEMPLATE
1. Timeline of events (detection to full recovery)
2. Initial access vector identification
3. Dwell time analysis (time from initial compromise to encryption)
4. Detection gaps identified
5. Response effectiveness metrics (MTTD, MTTC, MTTR)
6. Playbook improvements recommended
7. New detection rules deployed
8. Backup and recovery procedure updates

Term	Definition
Double Extortion	Ransomware tactic combining data encryption with data theft, threatening public release if ransom unpaid
Dwell Time	Duration between initial compromise and detection — ransomware operators average 5-9 days before encryption
MTTC	Mean Time to Contain — time from detection to successful isolation of affected systems
Kill Chain	Ransomware progression: Initial Access -> Execution -> Persistence -> Privilege Escalation -> Lateral Movement -> Collection -> Exfiltration -> Impact
Immutable Backup	Backup storage that cannot be modified or deleted for a defined retention period (WORM storage)
RTO/RPO	Recovery Time Objective / Recovery Point Objective — maximum acceptable downtime and data loss thresholds

RANSOMWARE PLAYBOOK EXECUTION — IR-2024-0500
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Phase 1 - Detection:
  Alert:      Mass file encryption detected on FILESERVER-03
  Variant:    LockBit 3.0 (confirmed via ID Ransomware)
  MTTD:       12 minutes from first encryption to SOC alert

Phase 2 - Containment:
  [DONE] FILESERVER-03 isolated via CrowdStrike at 14:35 UTC
  [DONE] SMB blocked enterprise-wide via firewall emergency rule
  [DONE] Compromised service account disabled in AD
  MTTC:       23 minutes

Phase 3 - Eradication:
  [DONE] 3 additional hosts with C2 beacon identified and isolated
  [DONE] Cobalt Strike C2 domain (c2[.]evil[.]com) sinkholed
  [DONE] Enterprise-wide IOC scan completed — no additional infections

Phase 4 - Recovery:
  [DONE] FILESERVER-03 rebuilt from gold image
  [DONE] Data restored from immutable Veeam backup (RPO: 4 hours)
  [DONE] Systems monitored 72 hours — no reinfection
  MTTR:       18 hours

Total Affected: 1 server, 3 workstations
Data Loss:      4 hours of file modifications (backup RPO)
Exfiltration:   No evidence of data exfiltration confirmed

Transfer of funds

Summary

SKILL.md

Building SOC Playbook for Ransomware

When to Use

Prerequisites

Workflow

Step 1: Define Detection Triggers

Step 2: Build Triage Decision Tree

Step 3: Containment Procedures

Step 4: Evidence Collection and Preservation

Step 5: Eradication and Recovery

Step 6: Post-Incident Documentation

Key Concepts

Tools & Systems

Common Scenarios

Output Format

Related skills