# Building Soc Playbook For Ransomware

Builds a structured SOC incident response playbook for ransomware attacks covering...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill building-soc-playbook-for-ransomware -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill building-soc-playbook-for-ransomware -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill building-soc-playbook-for-ransomware -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill building-soc-playbook-for-ransomware -g -a gemini-cli -y`

## Description

Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Building SOC Playbook for Ransomware

## When to Use

Use this skill when:
- SOC teams need a standardized ransomware response playbook for Tier 1-3 analysts
- An organization lacks documented procedures for ransomware containment and recovery
- Tabletop exercises reveal gaps in ransomware response coordination
- Compliance requirements (NIST CSF, ISO 27001) mandate documented incident playbooks

**Do not use** during an active ransomware incident as the sole guide, have pre-built playbooks tested and rehearsed before incidents occur.

## Prerequisites

- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with endpoint and network data
- EDR solution (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) with network isolation capability
- Backup infrastructure with tested recovery procedures and offline/immutable backups
- Communication plan with legal, executive leadership, and external IR retainer contacts
- MITRE ATT&CK knowledge for ransomware technique chains

## Workflow

### Step 1: Define Detection Triggers

Create SIEM detection rules for early ransomware indicators:

**Mass File Encryption Detection (Splunk):**
```spl
index=sysmon EventCode=11
| bin _time span=1m
| stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time
| where unique_files > 100
| eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO")
| where suspicious_extensions="YES" OR unique_files > 500
| sort - unique_files
```

**Shadow Copy Deletion (T1490):**
```spl
index=wineventlog sourcetype="WinEventLog:Security" OR index=sysmon EventCode=1
(CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*"
 OR CommandLine="*bcdedit*/set*recoveryenabled*no*" OR CommandLine="*wbadmin*delete*catalog*")
| table _time, Computer, User, ParentImage, Image, CommandLine
```

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/building-soc-playbook-for-ransomware/SKILL.md