/building-soc-playbook-for-ransomware

name: building-soc-playbook-for-ransomware
description: 'Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication,
  and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized
  response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.

  '
domain: cybersecurity
subdomain: soc-operations
tags:
- soc
- ransomware
- incident-response
- playbook
- nist
- mitre-attack
- containment
mitre_attack:
- T1486
- T1490
- T1489
- T1570
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Platform Hardening
- Restore Object
- Restore Configuration
- Restore Software
- Software Update
nist_csf:
- DE.CM-01
- DE.AE-02
- RS.MA-01
- DE.AE-06

Building SOC Playbook for Ransomware

When to Use

Use this skill when:

• SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts
• An organization lacks documented procedures for ransomware containment and recovery
• Tabletop exercises reveal gaps in ransomware response coordination
• Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks

**Do not use** during an active ransomware incident as the sole guide — have pre-built playbooks tested and rehearsed before incidents occur.

Prerequisites

• SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data
• EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability
• Backup infrastructure with tested recovery procedures and offline/immutable backups
• Communication plan with legal, executive leadership, and external IR retainer contacts
• MITRE ATT&CK knowledge for ransomware technique chains

Workflow

Step 1: Define Detection Triggers

Create SIEM detection rules for early ransomware indicators:

**Mass File Encryption Detection (Splunk):**

index=sysmon EventCode=11
| bin _time span=1m
| stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time
| where unique_files > 100
| eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO")
| where suspicious_extensions="YES" OR unique_files > 500
| sort - unique_files

**Shadow Copy Deletion (T1490):**

index=wineventlog sourcetype="WinEventLog:Security" OR index=sysmon EventCode=1
(CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*"
 OR CommandLine="*bcdedit*/set*recoveryenabled*no*" OR CommandLine="*wbadmin*delete*catalog*")
| table _time, Computer, User, ParentImage, Image, CommandLine

**Ransomware Note File Creation:**

index=sysmon EventCode=11
TargetFilename IN ("*README*.txt", "*DECRYPT*.txt", "*RANSOM*.txt", "*RECOVER*.html", "*HOW_TO*.txt")
| stats count by Computer, Image, TargetFilename
| where count > 5

**Elastic Security EQL variant:**

sequence by host.name with maxspan=2m
  [process where event.type == "start" and
    process.args : ("*vssadmin*", "*delete*", "*shadows*")]
  [file where event.type == "creation" and
    file.name : ("*README*DECRYPT*", "*RANSOM*", "*HOW_TO_RECOVER*")]

Step 2: Build Triage Decision Tree

RANSOMWARE ALERT TRIAGE
│
├── Is encryption actively occurring?
│   ├── YES → IMMEDIATE: Isolate host from network (Step 3)
│   │         Do NOT power off (preserve memory for forensics)
│   └── NO → Is this a pre-encryption indicator?
│       ├── Shadow copy deletion → HIGH PRIORITY: Isolate and investigate
│       ├── Known ransomware hash → HIGH PRIORITY: Block hash, scan enterprise
│       └── Suspicious process behavior → MEDIUM: Investigate, prepare isolation
│
├── How many hosts affected?
│   ├── Single host → Contained incident, follow host isolation procedure
│   ├── Multiple hosts (2-10) → Escalate to Tier 2, begin enterprise-wide scan
│   └── Enterprise-wide (>10) → Activate full IR team, engage external retainer
│
└── Is data exfiltration confirmed?
    ├── YES → Double extortion scenario, engage legal for breach notification
    └── NO/UNKNOWN → Check for Cobalt Strike/C2 beacons, review outbound transfers

Step 3: Containment Procedures

**Network Isolation via EDR (CrowdStrike Falcon):**

# Isolate host using CrowdStrike Falcon API
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["device_id_here"]}'

**Network Isolation via Microsoft Defender for Endpoint:**

# Isolate machine via MDE API
$headers = @{Authorization = "Bearer $token"}
$body = @{Comment = "Ransomware containment - IR-2024-0500"; IsolationType = "Full"} | ConvertTo-Json
Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" `
    -Method Post -Headers $headers -Body $body -ContentType "application/json"

**Firewall Emergency Rules:**

# Palo Alto — Block SMB lateral spread
set rulebase security rules RansomwareContainment from Trust to Trust
set rulebase security rules RansomwareContainment application ms-ds-smb
set rulebase security rules RansomwareContainment action deny
set rulebase security rules RansomwareContainment disabled no
commit

**Active Directory Emergency Actions:**

# Disable compromised account
Disable-ADAccount -Identity "compromised_user"

# Reset Kerberos TGT (if domain admin compromised)
# WARNING: This resets krbtgt and requires two resets 12+ hours apart
Reset-KrbtgtKeys -Server "DC-PRIMARY" -Force

# Block lateral movement by disabling remote services
Set-Service -Name "RemoteRegistry" -StartupType Disabled -Status Stopped

Step 4: Evidence Collection and Preservation

Collect forensic artifacts before remediation:

# Capture running processes a