building-soc-playbook-for-ransomware

name	building-soc-playbook-for-ransomware
description	Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","ransomware","incident-response","playbook","nist","mitre-attack","containment"]
mitre_attack	["T1486","T1490","T1489","T1570"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Platform Hardening","Restore Object","Restore Configuration","Restore Software","Software Update"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building SOC Playbook for Ransomware

When to Use

Use this skill when:

• SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts
• An organization lacks documented procedures for ransomware containment and recovery
• Tabletop exercises reveal gaps in ransomware response coordination
• Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks

Do not use during an active ransomware incident as the sole guide — have pre-built playbooks tested and rehearsed before incidents occur.

Prerequisites

• SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data
• EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability
• Backup infrastructure with tested recovery procedures and offline/immutable backups
• Communication plan with legal, executive leadership, and external IR retainer contacts
• MITRE ATT&CK knowledge for ransomware technique chains

Workflow

Step 1: Define Detection Triggers

Create SIEM detection rules for early ransomware indicators:

Mass File Encryption Detection (Splunk):

index=sysmon EventCode=11
| bin _time span=1m
| stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time
| where unique_files > 100
| eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO")
| where suspicious_extensions="YES" OR unique_files > 500
| sort - unique_files

Shadow Copy Deletion (T1490):

index=wineventlog sourcetype="WinEventLog:Security" OR index=sysmon EventCode=1
(CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*"
 OR CommandLine="*bcdedit*/set*recoveryenabled*no*" OR CommandLine="*wbadmin*delete*catalog*")
| table _time, Computer, User, ParentImage, Image, CommandLine

Ransomware Note File Creation:

index=sysmon EventCode=11
TargetFilename IN ("*README*.txt", "*DECRYPT*.txt", "*RANSOM*.txt", "*RECOVER*.html", "*HOW_TO*.txt")
| stats count by Computer, Image, TargetFilename
| where count > 5

Elastic Security EQL variant:

sequence by host.name with maxspan=2m
  [process where event.type == "start" and
    process.args : ("*vssadmin*", "*delete*", "*shadows*")]
  [file where event.type == "creation" and
    file.name : ("*README*DECRYPT*", "*RANSOM*", "*HOW_TO_RECOVER*")]