mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-29 15:40:58 +03:00
151 lines
4.3 KiB
Markdown
151 lines
4.3 KiB
Markdown
# Ransomware Incident Response Report
|
|
|
|
## Incident Overview
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Incident ID | IR-YYYY-NNN |
|
|
| Date Detected | YYYY-MM-DD HH:MM UTC |
|
|
| Ransomware Family | [LockBit/BlackCat/Cl0p/etc.] |
|
|
| Variant Version | [if known] |
|
|
| Severity | [Critical/High/Medium] |
|
|
| Incident Commander | [Name] |
|
|
| Status | [Active/Contained/Eradicated/Recovered] |
|
|
|
|
## Executive Summary
|
|
[2-3 sentence summary of the ransomware incident, impact, and current status]
|
|
|
|
## Ransomware Identification
|
|
| Attribute | Details |
|
|
|-----------|---------|
|
|
| Family/Variant | |
|
|
| File Extension | |
|
|
| Ransom Note Filename | |
|
|
| Bitcoin Wallet(s) | |
|
|
| Tor Payment URL | |
|
|
| Ransom Demand | |
|
|
| Decryptor Available | Yes/No (source: ) |
|
|
|
|
## Encryption Scope
|
|
|
|
### Affected Systems
|
|
| Hostname | IP Address | OS | Role | Encryption Status | Recovery Method |
|
|
|----------|-----------|-----|------|-------------------|----------------|
|
|
| | | | | Full/Partial/None | Backup/Decrypt/Rebuild |
|
|
|
|
### Affected Data
|
|
| Data Category | Classification | Volume (GB) | Location | Encrypted | Exfiltrated |
|
|
|--------------|---------------|-------------|----------|-----------|-------------|
|
|
| | | | | Yes/No | Yes/No/Unknown |
|
|
|
|
### Encryption Statistics
|
|
- Total encrypted files: [count]
|
|
- Total affected directories: [count]
|
|
- Estimated data volume encrypted: [GB/TB]
|
|
- Encryption completion: [percentage if still in progress]
|
|
|
|
## Attack Timeline
|
|
| Date/Time (UTC) | Event | Evidence Source |
|
|
|-----------------|-------|----------------|
|
|
| | Initial access | |
|
|
| | Credential harvesting | |
|
|
| | Lateral movement began | |
|
|
| | Data exfiltration (if applicable) | |
|
|
| | Security tools disabled | |
|
|
| | VSS/backups deleted | |
|
|
| | Encryption started | |
|
|
| | Encryption detected | |
|
|
| | Containment initiated | |
|
|
|
|
## Initial Access Vector
|
|
- [ ] Phishing email (attachment/link)
|
|
- [ ] Exploited public-facing application (CVE: ___)
|
|
- [ ] Compromised VPN/RDP credentials
|
|
- [ ] Supply chain compromise
|
|
- [ ] Insider threat
|
|
- [ ] Unknown (under investigation)
|
|
|
|
## Containment Actions
|
|
- [ ] Infected systems isolated from network
|
|
- [ ] C2 IPs/domains blocked at firewall
|
|
- [ ] Compromised accounts disabled
|
|
- [ ] Lateral movement protocols blocked
|
|
- [ ] Backup systems isolated and protected
|
|
- [ ] Enhanced monitoring deployed
|
|
|
|
## Backup and Recovery Assessment
|
|
|
|
### Backup Status
|
|
| Backup Type | Status | Last Good Date | Integrity Verified | Recovery Time |
|
|
|-------------|--------|---------------|-------------------|---------------|
|
|
| Volume Shadow Copies | Available/Deleted | | Yes/No | |
|
|
| On-premise backup (Veeam/etc.) | Available/Encrypted/Offline | | Yes/No | |
|
|
| Cloud backup | Available/Compromised | | Yes/No | |
|
|
| Immutable backup | Available/N/A | | Yes/No | |
|
|
| Tape backup | Available/N/A | | Yes/No | |
|
|
|
|
### Recovery Plan
|
|
| Priority | System | Recovery Method | Estimated Time | Status |
|
|
|----------|--------|----------------|---------------|--------|
|
|
| P1 | | | | |
|
|
| P2 | | | | |
|
|
| P3 | | | | |
|
|
|
|
## Ransom Payment Decision
|
|
- [ ] Payment NOT recommended (backups available)
|
|
- [ ] Payment under consideration (legal/executive review)
|
|
- [ ] Law enforcement consulted: [FBI/CISA/Local]
|
|
- [ ] Cyber insurance carrier notified: [Yes/No]
|
|
- [ ] External IR firm engaged: [Yes/No - Firm name]
|
|
|
|
## Indicators of Compromise (IOCs)
|
|
|
|
### Network IOCs
|
|
| IOC Type | Value | Context |
|
|
|----------|-------|---------|
|
|
| IP Address | | C2 server |
|
|
| Domain | | C2 domain |
|
|
| URL | | Payment site |
|
|
|
|
### File IOCs
|
|
| IOC Type | Value | Context |
|
|
|----------|-------|---------|
|
|
| SHA256 | | Ransomware binary |
|
|
| SHA256 | | Loader/dropper |
|
|
| Filename | | Ransom note |
|
|
|
|
### Host IOCs
|
|
| IOC Type | Value | Context |
|
|
|----------|-------|---------|
|
|
| Registry key | | Persistence |
|
|
| Scheduled task | | Execution |
|
|
| Service | | Persistence |
|
|
|
|
## Notifications
|
|
- [ ] Executive leadership briefed
|
|
- [ ] Legal counsel engaged
|
|
- [ ] Cyber insurance carrier notified
|
|
- [ ] Law enforcement notified (FBI IC3, CISA)
|
|
- [ ] Regulatory notification (if required): [GDPR/HIPAA/PCI/State laws]
|
|
- [ ] Customer notification (if required)
|
|
- [ ] Sector ISAC notified
|
|
|
|
## Lessons Learned
|
|
### What Worked
|
|
-
|
|
|
|
### What Failed
|
|
-
|
|
|
|
### Recommendations
|
|
1.
|
|
2.
|
|
3.
|
|
|
|
## Approvals
|
|
| Role | Name | Signature | Date |
|
|
|------|------|-----------|------|
|
|
| Incident Commander | | | |
|
|
| CISO | | | |
|
|
| Legal Counsel | | | |
|
|
| CEO/COO | | | |
|