| name | soc-playbook-rnsmwr |
| description | Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
|
| domain | cybersecurity |
| subdomain | soc-operations |
| tags | ["soc","ransomware","incident-response","playbook","nist","mitre-attack","containment"] |
| mitre_attack | ["T1486","T1490","T1489","T1570"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Platform Hardening","Restore Object","Restore Configuration","Restore Software","Software Update"] |
| nist_csf | ["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"] |
Building SOC Playbook for Ransomware
When to Use
Use this skill when:
- SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts
- An organization lacks documented procedures for ransomware containment and recovery
- Tabletop exercises reveal gaps in ransomware response coordination
- Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks
Do not use during an active ransomware incident as the sole guide — have pre-built playbooks tested and rehearsed before incidents occur.
Prerequisites
- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data
- EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability
- Backup infrastructure with tested recovery procedures and offline/immutable backups
- Communication plan with legal, executive leadership, and external IR retainer contacts
- MITRE ATT&CK knowledge for ransomware technique chains
Workflow
Step 1: Define Detection Triggers
Create SIEM detection rules for early ransomware indicators:
Mass File Encryption Detection (Splunk):
index=sysmon EventCode=11
| bin _time span=1m
| stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time
| where unique_files > 100
| eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO")
| where suspicious_extensions="YES" OR unique_files > 500
| sort - unique_files
Shadow Copy Deletion (T1490):
index=wineventlog sourcetype="WinEventLog:Security" OR index=sysmon EventCode=1
(CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*"
OR CommandLine="*bcdedit*/set*recoveryenabled*no*" OR CommandLine="*wbadmin*delete*catalog*")
| table _time, Computer, User, ParentImage, Image, CommandLine
Ransomware Note File Creation:
index=sysmon EventCode=11
TargetFilename IN ("*README*.txt", "*DECRYPT*.txt", "*RANSOM*.txt", "*RECOVER*.html", "*HOW_TO*.txt")
| stats count by Computer, Image, TargetFilename
| where count > 5
Elastic Security EQL variant:
sequence by host.name with maxspan=2m
[process where event.type == "start" and
process.args : ("*vssadmin*", "*delete*", "*shadows*")]
[file where event.type == "creation" and
file.name : ("*README*DECRYPT*", "*RANSOM*", "*HOW_TO_RECOVER*")]
