testing-ransomware-recovery-procedures

Test and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/xalgord/xalgorix --skill testing-ransomware-recovery-procedures

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

View all from this repository

Testing Ransomware Recovery Procedures

When to Use

Use this skill when:

Validating that ransomware recovery plans actually work under realistic conditions

Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements

Testing backup restore operations to confirm data integrity and completeness after simulated encryption

Conducting tabletop exercises or live recovery drills for ransomware scenarios

Auditing disaster recovery readiness as part of compliance or cyber insurance requirements

Do not use for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.

Common Misconfigurations & Verification

The backup that's never restored is an untested assumption: a successful backup job and a green dashboard do not prove recoverability — corruption, broken incremental chains, and missing application dependencies only surface on restore. Run an actual restore at least quarterly and treat "job succeeded" as unverified until a restore passes.

Measuring RTO without WRT understates reality: restore completion is not service restoration. Include validation and security-hardening time (Work Recovery Time) in the measured RTO, or the number you report to the business is fiction. Measure RPO as incident_time − backup_timestamp, not the schedule interval.

Recovery sequencing breaks silently: restoring an app before its database/AD/DNS dependency causes cascading failures that look like restore corruption. Validate the runbook restores Tier-1 dependencies (AD, DNS, DHCP) first and document the interdependency order.

Testing on the production network is dangerous and invalidates the test: a recovery drill must run in an air-gapped/segmented lab — confirm no routes to production exist (ip route show) before restoring, or you risk spreading the very infection you're rehearsing against.

Concrete verification the test passed: diff file counts and SHA-256 manifests of source vs restored data, run DB consistency checks (pg_isready, row counts), confirm the restore point predates the simulated infection and is from immutable/air-gapped storage, rotate credentials on restored systems, and record actual RTO/RPO against target with an explicit MEETS/FAILS verdict — not just "restore completed".

Prerequisites

Isolated recovery test environment (air-gapped or network-segmented lab)

Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)

Documented RTO/RPO targets per application tier from business impact analysis