Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-ransomware-incident-response/references/workflows.md

@@ -0,0 +1,133 @@
+# Ransomware Incident Response - Detailed Workflow
+
+## Phase 1: Detection and Initial Assessment (0-30 minutes)
+
+### Detection Sources
+1. EDR/AV alert for ransomware behavior (mass file encryption)
+2. User reports of inaccessible files or ransom notes
+3. SIEM correlation of suspicious patterns (VSS deletion + mass file writes)
+4. Backup system alerts for failed or corrupted backups
+5. Canary file monitoring triggers
+
+### Initial Assessment Steps
+1. Confirm ransomware activity (not a false positive or legitimate encryption)
+2. Identify patient zero (first infected system)
+3. Determine ransomware variant from ransom note or encrypted file extension
+4. Check if encryption is still in progress or completed
+5. Assess scope: single host, department, or enterprise-wide
+6. Activate incident response team and establish war room
+
+### Variant Identification
+1. Upload ransom note to ID Ransomware (id-ransomware.malwarehunterteam.com)
+2. Submit encrypted file sample to identify encryption algorithm
+3. Check file extension against known ransomware database
+4. Cross-reference IOCs with threat intelligence feeds
+5. Search for Bitcoin wallet addresses in threat intel databases
+
+## Phase 2: Containment (30-120 minutes)
+
+### Immediate Actions
+1. Network-isolate all confirmed infected hosts via EDR
+2. Block known C2 IPs/domains at perimeter firewall
+3. Disable file sharing (SMB, NFS) between network segments
+4. Block lateral movement protocols (RDP, WinRM, PsExec)
+5. Disable compromised user/service accounts
+6. Take backup systems offline (protect from encryption)
+
+### Network Segmentation
+1. Implement emergency firewall rules between VLANs
+2. Disable inter-VLAN routing for affected segments
+3. Block east-west traffic for non-essential ports
+4. Enable full packet capture on affected segments
+5. Deploy network honey tokens
+
+### Backup Protection Priority
+1. Disconnect backup networks from production
+2. Verify immutable backup copies exist and are intact
+3. Test a sample restoration to confirm backup viability
+4. Document last known good backup date for each system
+5. If using cloud backups, verify object lock/WORM settings
+
+## Phase 3: Investigation (2-48 hours)
+
+### Determine Initial Access Vector
+1. Review VPN/remote access logs for compromised credentials
+2. Check email logs for phishing delivery
+3. Analyze exploitation of public-facing applications
+4. Review RDP brute force attempts in event logs
+5. Check supply chain/third-party access logs
+
+### Map Attack Timeline
+1. Correlate SIEM/EDR data to build attack chronology
+2. Identify dwell time (initial access to encryption)
+3. Map lateral movement path through the network
+4. Identify all systems accessed by the attacker
+5. Determine if data was exfiltrated before encryption
+
+### Evidence Collection
+1. Capture memory images from key systems
+2. Create forensic disk images before remediation
+3. Export relevant SIEM logs (authentication, file access, network)
+4. Preserve EDR detection data and timeline
+5. Document all ransom communications
+
+## Phase 4: Eradication (24-72 hours)
+
+### Remove Attacker Persistence
+1. Identify and remove all backdoors (web shells, RATs, implants)
+2. Remove scheduled tasks created by the attacker
+3. Clean malicious registry entries
+4. Remove unauthorized user accounts
+5. Revoke all compromised credentials (including KRBTGT if needed)
+6. Patch the vulnerability used for initial access
+
+### Validate Clean State
+1. Run full AV/EDR scans on all systems
+2. Scan with YARA rules specific to the ransomware family
+3. Verify no unauthorized processes or services
+4. Check for fileless persistence mechanisms
+5. Validate Group Policy objects are clean
+
+## Phase 5: Recovery (24 hours - 2 weeks)
+
+### Recovery Prioritization
+| Priority | System Category | Recovery Target |
+|----------|----------------|-----------------|
+| P1 | Domain controllers, DNS, DHCP | 4-8 hours |
+| P2 | Email, communication systems | 8-24 hours |
+| P3 | Core business applications | 24-72 hours |
+| P4 | File shares, secondary systems | 3-7 days |
+| P5 | Non-critical workstations | 1-2 weeks |
+
+### Recovery Steps
+1. Rebuild systems from known-good images (not infected backups)
+2. Restore data from verified clean backups
+3. Apply all security patches before reconnecting to network
+4. Reset all passwords enterprise-wide
+5. Implement MFA on all remote access
+6. Reconnect systems in phases with enhanced monitoring
+7. Verify data integrity after restoration
+
+### Decryption Assessment
+1. Check nomoreransom.org for available decryptors
+2. Contact law enforcement for potential seized decryption keys
+3. Assess if partial decryption is possible
+4. Evaluate third-party decryption services (with caution)
+5. Document any data that cannot be recovered
+
+## Phase 6: Post-Incident (1-4 weeks)
+
+### Lessons Learned
+1. Conduct formal after-action review
+2. Document complete attack timeline
+3. Identify what worked and what failed in the response
+4. Update incident response playbook based on findings
+5. Brief executive leadership and board
+
+### Preventive Improvements
+1. Implement or enhance immutable backups
+2. Deploy additional network segmentation
+3. Improve endpoint detection rules
+4. Conduct security awareness training
+5. Test backup restoration procedures regularly
+6. Implement privileged access management (PAM)