skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

building-soc-playbook-for-ransomware

Builds a structured SOC incident response playbook for ransomware covering detection, containment, eradication, and recovery.

954|172|Updated Mar 13, 2026
Search Tags:#ransomware#incident response#NIST#containment#mitre att&ck#soc playbook#siem detection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill building-soc-playbook-for-ransomware
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: building-soc-playbook-for-ransomware
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/building-soc-playbook-for-ransomware
Command: npx skills add https://github.com/xalgord/xalgorix --skill building-soc-playbook-for-ransomware

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC teams often lack formalized, tested procedures for ransomware incidents, leading to slow containment, inconsistent triage decisions, and compliance gaps. This Skill produces a complete ransomware response playbook aligned to NIST SP 800-61 and MITRE ATT&CK so Tier 1-3 analysts follow one standardized process.

Core Features & Use Cases

  • Detection Engineering: Ready-to-deploy SIEM queries for Splunk and Elastic Security covering mass file encryption, shadow copy deletion (T1490), and ransom note creation.
  • Triage Decision Tree: Branching logic for active encryption, pre-encryption indicators, host count escalation, and double-extortion assessment.
  • Containment & Recovery Procedures: EDR isolation commands for CrowdStrike and Microsoft Defender for Endpoint, firewall emergency rules, AD account actions, forensic evidence collection, and backup-based recovery steps.
  • Use Case: A SOC manager preparing for a tabletop exercise uses this Skill to generate a ransomware playbook with detection rules, isolation runbooks, and a post-incident review template mapped to NIST CSF controls.

Quick Start

Build a ransomware incident response playbook for our SOC that includes Splunk detection queries, CrowdStrike host isolation steps, and a post-incident review template aligned to NIST SP 800-61.

Frequently Asked Questions about building-soc-playbook-for-ransomware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a ransomware incident response playbook for a SOC?▼

Define SIEM detection triggers for mass file encryption and shadow copy deletion, build a triage decision tree, then document containment, evidence collection, eradication, and recovery procedures. This Skill generates that full structure aligned to NIST SP 800-61 and MITRE ATT&CK.

What SIEM queries detect ransomware encryption activity?▼

Detect mass file encryption by counting distinct file creation events per host per minute in Sysmon EventCode 11, and flag shadow copy deletion via vssadmin, wmic, or bcdedit command lines. The Skill provides ready Splunk SPL and Elastic EQL queries for these patterns.

Does this playbook work with CrowdStrike and Microsoft Defender for Endpoint?▼

Yes, the containment section includes API-based network isolation commands for both CrowdStrike Falcon and Microsoft Defender for Endpoint, plus firewall emergency rules and Active Directory account disablement steps.

Should I power off a host during an active ransomware attack?▼

No, isolate the host from the network but keep it powered on to preserve memory for forensic analysis. The playbook's triage tree specifies network isolation via EDR as the immediate containment action.

When should this playbook not be used?▼

Do not use it as the sole guide during an active ransomware incident. Playbooks must be built, tested, and rehearsed before incidents occur so analysts execute familiar procedures under pressure.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
UnitOneAIUnitOneAI
44

post-incident-review

Generate NIST SP 800-61 Rev 2 post-incident review reports with root cause analysis and metrics.

Official
Intermediate
blamejsblamejs

ransomware-response

Screen sanctions, check decryptors, notify insurers, and test backups during ransomware incidents.

Official
Advanced
aviskaaraviskaar
6

security-operations

Establish and manage SOC capabilities with SIEM configuration and incident response.

Official
Advanced