building-soc-playbook-for-ransomware
From the author
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
Install
npx skills add 26zl/cybersec-toolkit --skill building-soc-playbook-for-ransomware -a claude-code
Installs to .claude/skills/building-soc-playbook-for-ransomware/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- building-incident-response-playbook26zl/cybersec-toolkitDesigns and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria, RACI matrices, and integration with SOAR platforms. Activates for requests involving IR playbook creation, incident response procedure documentation, response runbook development, or SOAR playbook design.Design★ 82
- performing-ransomware-response26zl/cybersec-toolkitExecutes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.Security★ 82
- ir-playbook-ransomwaregensecaihq/Wazuh-AutopilotIncident-response playbook for ransomware — mass file modification/encryption, ransom notes, shadow-copy and backup deletion, service stopping and log clearing; use when Wazuh shows FIM bursts (rules 550, 553, 554), antimalware detections (rules 62113, 87105), audit-log clearing (rule 60117) or recovery-inhibition commands. Containment within minutes.Productivity★ 60
- ir-playbookUnitOneAI/SecuritySkillsExecutes a structured incident response workflow based on NIST SP 800-61 Rev 2 and the SANS Incident Handler's Handbook. Auto-invoked when the user reports a security incident, asks how to respond to a breach, or needs help with incident classification, containment decisions, stakeholder notification, or evidence preservation. Produces an incident response plan with severity determination, containment decision tree, communication templates, and escalation criteria.Security★ 94
- incident-runbook-templateswshobson/agentsCreate structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing system; creating database incident procedures covering connection pool exhaustion, replication lag, and disk space alerts; onboarding new on-call engineers who need step-by-step recovery guides written for a 3 AM brain; or standardizing escalation matrices across multiple engineering teams.Data★ 41.7K
- recovering-from-ransomware-attack26zl/cybersec-toolkitExecutes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in