--- name: building-ransomware-playbook-with-cisa-framework-d3eed2727b5e description: Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise. domain: cybersecurity subdomain: ransomware-defense tags: - ransomware - incident-response - CISA - playbook - compliance - NIST version: 1.0.0 author: mahipal license: Apache-2.0 nist_csf: - PR.DS-11 - RS.MA-01 - RC.RP-01 - PR.IR-01 mitre_attack: - T1486 - T1490 - T1489 - T1078 - T1021.002 mitre_f3: version: '1.1' tactics: - initial-access - monetization techniques: - id: T1660 name: Phishing tactic: initial-access source: attack - id: T1110 name: Brute Force tactic: initial-access source: attack - id: F1018 name: Convert to Cryptocurrency tactic: monetization source: f3 - id: F1047 name: Transfer of funds tactic: monetization source: f3 --- # Building Ransomware Playbook with CISA Framework ## When to Use - An organization needs to create or update its ransomware incident response playbook following CISA guidelines - A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework - Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations - During tabletop exercises to validate that the organization's ransomware response steps match industry best practices - After a ransomware incident to update the playbook with lessons learned and close identified gaps **Do not use** as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction. ## Prerequisites - Familiarity with the CISA StopRansomware Guide (cisa.gov/stopransomware/ransomware-guide) - NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover) - Inventory of critical assets, backup infrastructure, and communication channels - Defined roles and responsibilities for incident response team members - Python 3.8+ for playbook generation and compliance checking automation - Access to organization's asset inventory and backup configuration documentation ## Workflow ### Step 1: Preparation Phase (CISA Part 1 - Prevention) Establish ransomware-specific defenses before an incident: ``` CISA Preparation Checklist: ━━━━━━━━━━━━━━━━━━━━━━━━━━ [ ] Maintain offline, encrypted backups tested for restoration [ ] Create and exercise a cyber incident response plan (IRP) [ ] Implement network segmentation between IT and OT networks [ ] Enable MFA on all remote access and privileged accounts [ ] Deploy endpoint detection and response (EDR) on all endpoints [ ] Disable or restrict RDP; require VPN for remote access [ ] Maintain a software/hardware asset inventory [ ] Apply patches within 48 hours for internet-facing systems [ ] Configure email filtering and disable macro execution by default [ ] Conduct regular phishing awareness training [ ] Implement application allowlisting (AppLocker/WDAC) [ ] Test backup restoration quarterly and document RTO/RPO ``` ### Step 2: Detection and Analysis Phase Identify ransomware indicators and assess scope: ``` Detection Indicators: ━━━━━━━━━━━━━━━━━━━━ - Mass file rename operations with new extensions (.locked, .encrypted) - Ransom notes appearing in directories (README.txt, DECRYPT.html) - Volume Shadow Copy deletion (vssadmin delete shadows) - Abnormal CPU usage from encryption processes - EDR/AV alerts for known ransomware signatures - Network connections to known C2 infrastructure - Unusual lateral movement via SMB or PsExec - Sysmon Event ID 11 (file creation) spikes Initial Analysis Steps (CISA): 1. Take system images and memory captures of affected devices 2. Identify patient zero and initial access vector 3. Determine the ransomware family (ID Ransomware, ransom note analysis) 4. Assess encryption scope: which systems, shares, and data are affected 5. Check if data exfiltration occurred (double extortion indicator) ``` ### Step 3: Containment Phase Stop the spread and preserve evidence: ``` Immediate Containment (First 1-4 hours): ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. Isolate affected systems from the network (disable NICs, VLAN quarantine) 2. If unable to disconnect, power down affected systems 3. Disable shared drives to prevent encryption spread 4. Reset credentials for compromised accounts (especially admin/service accounts) 5. Block known ransomware IOCs at firewall/proxy (C2 domains, IPs) 6. Preserve forensic evidence (memory dumps, disk images, logs) 7. Engage legal counsel and prepare breach notification if data exfiltrated Extended Containment: - Identify and patch the initial access vector (phishing, RDP, VPN vuln) - Audit all Active Directory accounts for persistence (scheduled tasks, services) - Check for backdoors or additional malware beyond the ransomware payload ``` ### Step 4: Eradication and Recovery Phase Remove the threat and restore operations: ``` CISA Recovery Steps: ━━━━━━━━━━━━━━━━━━━ 1. Rebuild affected systems from known-clean images (do NOT decrypt in place) 2. Restore data from offline backups (verify backup integrity first) 3. Reset ALL passwords including service accounts, krbtgt (twice, 12h apart) 4. Scan restored systems with updated AV/EDR before reconnecting to network 5. Re-enable services in priority order based on business criticality 6. Monitor restored systems intensively for 72 hours for reinfection Recovery Priority Matrix: P1 (0-4h): Domain controllers, DNS, authentication infrastructure P2 (4-24h): Email, critical business applications, databases P3 (1-3d): File servers, departmental applications P4 (3-7d): Non-critical systems, development environments ``` ### Step 5: Post-Incident Activity Document lessons learned and improve defenses: ``` Post-Incident Report Template: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. Executive summary: What happened, impact, resolution 2. Timeline: Detection to full recovery with timestamps 3. Root cause analysis: Initial access vector and propagation path 4. Scope: Number of systems, data volumes, business impact in hours/dollars 5. Response effectiveness: What worked, what failed, what was missing 6. Recommendations: Specific technical and procedural improvements 7. Compliance actions: Notification timeline, regulatory obligations met 8. Updated playbook: Revisions based on lessons learned ``` ## Verification - Validate playbook completeness against CISA StopRansomware checklist items - Conduct tabletop exercise using the playbook with all stakeholders - Verify backup restoration procedures work within documented RTO targets - Test communication plans including out-of-band channels - Confirm legal and regulatory notification procedures are current - Review and update the playbook at least annually or after any incident ## Key Concepts | Term | Definition | |------|------------| | **CISA StopRansomware Guide** | Joint CISA/MS-ISAC/NSA/FBI guide providing ransomware prevention best practices and response checklists | | **RTO/RPO** | Recovery Time Objective (max downtime) and Recovery Point Objective (max data loss); critical metrics for backup planning | | **Double Extortion** | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless paid | | **Patient Zero** | The first system compromised in an incident; identifying it reveals the initial access vector | | **Tabletop Exercise** | Simulated incident scenario walked through by the response team to validate the playbook without live systems | ## Tools & Systems - **CISA StopRansomware Guide**: Primary framework for ransomware response planning and prevention - **NIST CSF**: Cybersecurity Framework providing the Identify/Protect/Detect/Respond/Recover structure - **ID Ransomware**: Service for identifying ransomware families from encrypted files and ransom notes - **MITRE ATT&CK**: Technique framework for mapping ransomware TTPs to detection opportunities - **Velociraptor**: Endpoint visibility tool for rapid triage and forensic artifact collection during incidents --- Source attribution: hironow Original project: https://github.com/hironow/cyber/blob/20efb3a6a2a9e7ebbde38ed32325979866110540/.agents/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by the Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding any notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. Please do not remove or change the license header comment from a contributed file except when necessary. Copyright 2026 mukul975 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: hironow Original project: https://github.com/hironow/cyber/blob/20efb3a6a2a9e7ebbde38ed32325979866110540/.agents/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Legal, Operations Roles: Business Process Analyst, Compliance Officer, Security Engineer Specialties: Specialty not specified Tools: Tool not specified Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 43918b4f9f02fbcce9dc9cf8ca6bdca2cbebeb1d39130bd070d3a1d319055bcd