Initial commit - 611 cybersecurity skills across all subdomains

skills/recovering-from-ransomware-attack/references/standards.md

@@ -0,0 +1,20 @@
+# Standards & References - Recovering from Ransomware Attack
+
+## Frameworks
+- NIST SP 800-61r3: Computer Security Incident Handling Guide (Recover phase)
+- NIST IR 8374: Ransomware Risk Management - Recovery section
+- CISA #StopRansomware Guide: Recovery checklist
+- CIS Controls v8: Control 11 (Data Recovery)
+- NIST CSF 2.0: Recover function (RC.RP, RC.CO)
+
+## AD Recovery
+- Microsoft: AD Forest Recovery Guide - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-guide
+- DSInternals: https://github.com/MichaelGrafnetter/DSInternals
+- krbtgt reset guidance: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-resetting-the-krbtgt-password
+
+## MITRE ATT&CK (Recovery Validation)
+- T1053: Scheduled Task/Job (persistence to check)
+- T1543: Create or Modify System Process (persistence to check)
+- T1547: Boot or Logon Autostart Execution (persistence to check)
+- T1558.001: Golden Ticket (must reset krbtgt)
+- T1098: Account Manipulation (check for backdoor accounts)

skills/recovering-from-ransomware-attack/references/workflows.md

@@ -0,0 +1,65 @@
+# Workflows - Recovering from Ransomware Attack
+
+## Workflow 1: Recovery Decision and Planning
+
+```
+Containment Complete + Forensics Initiated
+  |
+  v
+[Assess backup availability]
+  |-- Immutable copies intact? --> Primary recovery path
+  |-- Air-gapped copies available? --> Secondary recovery path
+  |-- No clean backups? --> Consider decryption key (paid or NoMoreRansom)
+  |
+  v
+[Determine recovery scope]
+  |-- Full rebuild vs. selective restore
+  |-- Identify minimum viable recovery set
+  |
+  v
+[Map system dependencies]
+  |-- AD/DNS -> Database -> Application -> Web
+  |
+  v
+[Estimate recovery timeline per tier]
+  |
+  v
+[Brief executive team on recovery plan and timeline]
+  |
+  v
+[Begin recovery]
+```
+
+## Workflow 2: System Recovery Execution
+
+```
+[Establish clean recovery VLAN]
+  |
+  v
+[Phase 1: Identity Recovery]
+  |-- Restore DCs from verified backup
+  |-- Reset krbtgt (2x)
+  |-- Reset all admin passwords
+  |-- Validate AD health (dcdiag)
+  |
+  v
+[Phase 2: Critical Systems]
+  |-- Restore databases
+  |-- Verify data consistency
+  |-- Restore core applications
+  |-- Test application functionality
+  |
+  v
+[Phase 3: Important Systems]
+  |-- Restore in groups of 5-10
+  |-- Validate each before proceeding
+  |
+  v
+[Phase 4: Remaining Systems]
+  |
+  v
+[Each system: Scan for persistence -> Patch -> Deploy EDR -> Connect]
+  |
+  v
+[Post-recovery monitoring (7-14 days elevated alert)]
+```