respond-ransomware

name	respond-ransomware
description	Respond to a ransomware incident following PICERL methodology. Use when ransomware is detected or suspected. Orchestrates identification, containment, eradication, and recovery phases. Requires CASE_ID and initial indicators.
required_roles	{"chronicle":"roles/chronicle.admin","soar":"roles/chronicle.soarAdmin","gti":"GTI Enterprise","scc":"roles/securitycenter.adminEditor"}
personas	["incident-responder"]

Ransomware Incident Response Skill

Structured workflow for responding to suspected ransomware incidents using the PICERL model.

Inputs

• CASE_ID - SOAR case ID for the incident
• ALERT_GROUP_IDENTIFIERS - Alert group identifiers from SOAR
• INITIAL_INDICATORS - Initial detection info:
  • Affected endpoint(s)
  • File hashes observed
  • Ransom note details (handle carefully)
  • Suspicious network connections

Required Outputs

After completing each phase, you MUST report these outputs:

Identification Phase

Output	Description
AFFECTED_SYSTEMS	Systems confirmed infected with ransomware
RANSOMWARE_VARIANT	Ransomware family/variant identified
ENCRYPTION_STATUS	Current encryption state of affected systems
RANSOMWARE_IOCS	File hashes, ransom note patterns, malicious files

Containment Phase

Output	Description
ISOLATED_SYSTEMS	Systems successfully isolated from network
BLOCKED_IOCS	IOCs blocked at firewall/proxy
C2_INDICATORS	C2 domains/IPs discovered during containment

Eradication Phase

Output	Description
CLEANED_SYSTEMS	Systems with malware/persistence removed
REMOVED_PERSISTENCE	Persistence mechanisms identified and removed

Recovery Phase

Output	Description
RESTORED_SYSTEMS	Systems restored to operational state
VALIDATION_STATUS	Post-recovery validation results

PICERL Phases

Phase 1: Preparation (Ongoing)

Prerequisites - verify before proceeding:

• Tool connectivity (SIEM, SOAR, GTI, EDR)
• Backup availability and status
• Communication/escalation plans

---

Phase 2: Identification

Step 2.1: Get Context

secops-soar.get_case_full_details(case_id=CASE_ID)

Use /check-duplicates to verify this isn't already under investigation.

Step 2.2: Identify Ransomware Strain

If file hash available:

gti-mcp.get_file_report(hash=FILE_HASH)

If name/family known:

gti-mcp.search_threats(query="LockBit ransomware", collection_type="malware-family")

Document: IDENTIFIED_STRAIN

Step 2.3: Investigate Initial Access & Lateral Movement

Search SIEM for activity BEFORE encryption:

secops-mcp.search_security_events(
    text="Suspicious logins, RDP, exploit attempts for affected endpoints",
    hours_back=168
)

Look for:

• Suspicious logins to affected endpoints
• Lateral movement tools (PsExec, Cobalt Strike)
• Credential dumping activity
• Network connections from affected endpoints

Identify: INITIAL_ACCESS_VECTOR, POTENTIAL_ADDITIONAL_SYSTEMS

Step 2.4: Initial Scope Assessment

Compile:

• AFFECTED_ENDPOINTS - Confirmed infected systems
• MALICIOUS_IOCs - Network IOCs (C2 domains/IPs)

Step 2.5: Check Related Cases

Use /find-relevant-case with affected entities.

Step 2.6: Document

Use /document-in-case with identification findings.

---

Phase 3: Containment

CRITICAL: Speed is essential. Contain first, investigate deeper later.

Step 3.1: Isolate Affected Endpoints

For each endpoint in AFFECTED_ENDPOINTS and POTENTIAL_ADDITIONAL_SYSTEMS:

Use /confirm-action:

"Isolate endpoint [HOSTNAME] from network?"

If confirmed, trigger endpoint isolation (via EDR or network).

Step 3.2: Block Network IOCs

For each IOC in MALICIOUS_IOCs:

Use /confirm-action:

"Block IOC [VALUE] at firewall/proxy?"

If confirmed, implement blocks.

Step 3.3: Contain User Accounts

If compromised user identified: → Trigger /respond-compromised-account

Step 3.4: Verify Containment

Monitor SIEM for continued activity:

secops-mcp.search_security_events(
    text="Activity from contained systems or IOCs",
    hours_back=1
)

Use /document-in-case with containment status.

---

Phase 4: Eradication

Step 4.1: Identify Persistence

Review GTI reports for known persistence TTPs of IDENTIFIED_STRAIN.

Common mechanisms:

• Scheduled tasks
• Services
• Registry run keys
• WMI subscriptions

Step 4.2: Remove Malware & Persistence

(Requires EDR/endpoint tools)

• Remove ransomware executables
• Delete persistence mechanisms
• Note: Re-imaging often preferred over cleaning

Step 4.3: Scan Systems

Perform thorough AV/EDR scans on affected systems.

Use /document-in-case with eradication actions.

---

Phase 5: Recovery

Step 5.1: Check Decryptor Availability

Based on IDENTIFIED_STRAIN, check:

• NoMoreRansom.org
• Security vendor decryptor tools

Step 5.2: Determine Recovery Strategy

Options:

1. Restore from clean backups (most common)
2. Use decryptor if available
3. Rebuild systems from scratch

Step 5.3: Execute Recovery

(Involves IT Ops/System Admins)

• Rebuild/restore systems
• Verify backup integrity before restore
• Patch and harden before reconnecting
• Restore data from clean backups

Step 5.4: Monitor & Lift Containment

• Monitor recovered systems closely
• Gradually remove isolation measures
• Watch for signs of residual infection

Use /document-in-case with recovery status.

---

Phase 6: Lessons Learned

Use /generate-report with comprehensive incident report.

Conduct post-incident review:

• Initial access vector analysis
• Detection timeline review
• Response effectiveness
• Recovery success
• Recommendations for prevention

---

Critical Warnings

• DO NOT delay containment to perform deep analysis
• DO NOT restore without verifying backups/cleaning
• DO check for lateral movement before closing
• ALWAYS confirm isolation actions with analyst

Quick Reference

Phase	Key Actions	Skills Used
Identification	Strain ID, scope	/check-duplicates, /find-relevant-case
Containment	Isolate, block	/confirm-action, /document-in-case
Eradication	Remove persistence	EDR tools
Recovery	Restore systems	IT Ops coordination
Lessons Learned	Report, review	/generate-report