building-soc-playbook-for-ransomware

# Building SOC Playbook for Ransomware ## When to Use Use this skill when: - SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts - An organization lacks documented procedures for ransomware containment and recovery - Tabletop exercises reveal gaps in ransomware response coordination - Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks **Do not use** during an active ransomware incident as the sole guide — have pre-built playbooks tested and rehearsed before incidents occur. ## Prerequisites - SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data - EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability - Backup infrastructure with tested recovery procedures and offline/immutable backups - Communication plan with legal, executive leadership, and external IR retainer contacts - MITRE ATT&CK knowledge for ransomware technique chains ## Workflow ### Step 1: Define Detection Triggers Create SIEM detection rules for early ransomware indicators: **Mass File Encryption Detection (Splunk):** ```spl index=sysmon EventCode=11 | bin _time span=1m | stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time | where unique_files > 100 | eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO") | where suspicious_extensions="Y...