building-soc-playbook-for-ransomware

name	building-soc-playbook-for-ransomware
description	Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
domain	cybersecurity
tags	["soc","ransomware","incident-response","playbook","nist","mitre-attack","containment"]
subdomain	soc-operations
mitre_attack	["T1486","T1490","T1489","T1570"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Platform Hardening","Restore Object","Restore Configuration","Restore Software","Software Update"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building Soc Playbook For Ransomware

Overview

Cybersecurity skill for building soc playbook for ransomware. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "building soc playbook for ransomware"
• "SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts"
• "An organization lacks documented procedures for ransomware containment and recov"
• "Tabletop exercises reveal gaps in ransomware response coordination"

Use this skill when:

• SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts
• An organization lacks documented procedures for ransomware containment and recovery
• Tabletop exercises reveal gaps in ransomware response coordination
• Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks

Do not use during an active ransomware incident as the sole guide — have pre-built playbooks tested and rehearsed before incidents occur.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data
• EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability
• Backup infrastructure with tested recovery procedures and offline/immutable backups
• Communication plan with legal, executive leadership, and external IR retainer contacts
• MITRE ATT&CK knowledge for ransomware technique chains

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}