=============================================================================== INCIDENT RESPONSE PLAYBOOK — RANSOMWARE / DATA EXFILTRATION Organization: Globex Corporation Version: 2.1 (Draft — Gaps Marked for Student Completion) Last Reviewed: 2026-02-15 Playbook Owner: SOC Manager Classification: INTERNAL — RESTRICTED =============================================================================== SECTION 1: DETECTION CRITERIA =============================================================================== This playbook is activated when ONE or MORE of the following conditions are met: [X] EDR alert for known ransomware binary or behavior (file encryption, ransom note creation, mass file rename with unusual extension) [X] SIEM correlation rule: data staging + large outbound transfer (>50 MB to external IP within 30 minutes) [X] User report of encrypted files, ransom note on screen, or unusual "file access denied" errors across network shares [X] IDS/IPS signature match for known ransomware C2 communication [X] DLP alert for bulk sensitive data transfer to external destination [ ] ________________________________________________________ (Student: Add one additional detection criterion relevant to the scenario in soc-alert-feed.txt) SECTION 2: SEVERITY CLASSIFICATION =============================================================================== Classify the incident based on scope and impact: SEVERITY 1 (CRITICAL) — Conditions: - Active data exfiltration confirmed - Ransomware actively encrypting production systems - Domain controller compromised - More than 10 hosts affected Response time: IMMEDIATE (within 15 minutes) Notification: CISO, CTO, Legal, Communications, External IR retainer SEVERITY 2 (HIGH) — Conditions: - Ransomware contained to single host or segment - Data staging detected but exfiltration not confirmed - Lateral movement detected but privilege escalation not confirmed Response time: Within 1 hour Notification: SOC Manager, IT Director, Security Team Lead SEVERITY 3 (MEDIUM) — Conditions: - Suspicious indicators (C2 beacon, encoded PowerShell) on single host - No confirmed lateral movement or data access Response time: Within 4 hours Notification: SOC Manager, Tier 2 Analyst >>> STUDENT TASK: Based on the soc-alert-feed.txt scenario, what severity would you assign at each of these timestamps? Justify each: - At 06:18 (first PowerShell beacon detected) - At 06:55 (EternalBlue exploitation) - At 07:22 (data exfiltration detected) SECTION 3: INITIAL RESPONSE (First 30 Minutes) =============================================================================== Role Assignments: Incident Commander: _________________________________ (assign by name/role) Technical Lead: _________________________________ (assign by name/role) Communications Lead: _________________________________ (assign by name/role) Scribe: _________________________________ (assign by name/role) Step 3.1 — Confirm the Incident [X] Verify the triggering alert is a true positive (not a false positive or test). Check raw log data in SIEM. [X] Determine: Is this an active, ongoing incident or historical? [ ] ________________________________________________________ [ ] ________________________________________________________ (Student: Add 2 additional confirmation steps. What would you verify to confirm the alert feed scenario is a real attack?) Step 3.2 — Scope Assessment [X] Identify the initially compromised host(s) and user account(s) [X] Query SIEM for related alerts in the past 24 hours for the same source IP, user, and destination [X] Check EDR console for beacon/implant activity on other hosts [ ] ________________________________________________________ [ ] ________________________________________________________ (Student: Add 2 additional scoping steps. How would you determine the full blast radius of this incident?) Step 3.3 — Preserve Evidence (Before Containment) [X] Screenshot active alerts and dashboards [X] Export relevant SIEM search results (raw logs) for the incident window [ ] ________________________________________________________ [ ] ________________________________________________________ [ ] ________________________________________________________ (Student: Add 3 evidence preservation steps. Think about volatile evidence that will be lost once containment actions are taken.) SECTION 4: CONTAINMENT PROCEDURES =============================================================================== Step 4.1 — Network Containment [X] Isolate compromised host(s) via EDR network isolation Command: CrowdStrike > Host Management > Network Containment > Enable [X] Add attacker C2 IPs/domains to firewall block list IPs to block: _______________________________________________ Domains to block: ___________________________________________ (Student: Fill in from the soc-alert-feed.txt) [X] Block exfiltration destination IP at edge firewall IP to block: ________________________________________________ (Student: Fill in from the soc-alert-feed.txt) [ ] ________________________________________________________ [ ] ________________________________________________________ (Student: Add 2 additional network containment actions. Consider what other network paths the attacker may use.) Step 4.2 — Account Containment [X] Disable compromised user account(s) in Active Directory Accounts to disable: ________________________________________ (Student: List all compromised accounts from the alert feed) [X] Reset passwords for all accounts that authenticated on compromised hosts [ ] ________________________________________________________ [ ] ________________________________________________________ (Student: Add 2 additional account containment actions. Think about service accounts, backdoor accounts, and Kerberos tickets.) Step 4.3 — Endpoint Containment [X] Quarantine malware samples identified by EDR [X] Kill malicious processes on compromised hosts Processes to kill: __________________________________________ (Student: List from the alert feed) [ ] ________________________________________________________ (Student: Add 1 additional endpoint containment action) SECTION 5: ERADICATION CHECKLIST =============================================================================== Complete ALL items before declaring eradication. Check each box only after verification. [ ] All identified C2 implants/beacons removed from all hosts Hosts to clean: ____________________________________________ (Student: List all hosts with confirmed beacons) [ ] All persistence mechanisms removed Registry keys: _____________________________________________ Scheduled tasks: ___________________________________________ (Student: List specific persistence artifacts from alert feed) [ ] All backdoor accounts deleted Accounts: __________________________________________________ (Student: List from alert feed) [ ] Compromised credentials rotated - Domain admin passwords - Service account passwords (especially: _____________________) - KRBTGT password (double rotation, 12+ hours apart) - Local administrator passwords on all systems [ ] Vulnerable systems patched - SRV-PRINT01: _____________________________________________ (Student: Specify the vulnerability and required patch) - Any other unpatched hosts identified during investigation [ ] Firewall rules tightened Rule changes: ______________________________________________ (Student: Specify at least 3 firewall rule changes from your network-topology.txt analysis) [ ] SIEM detection rules updated New rules: _________________________________________________ (Student: Specify at least 3 new detection rules from your detection-gaps.txt analysis) SECTION 6: RECOVERY STEPS =============================================================================== Step 6.1 — System Recovery [X] Rebuild compromised hosts from known-good images (do NOT simply "clean" — rebuild from scratch) [X] Restore data from verified clean backups (verify backup integrity and confirm backups pre-date the compromise) [X] Verify restored systems are fully patched before reconnecting to network [X] Re-enable network connectivity in stages: one host at a time, monitor for 30 minutes before connecting the next Step 6.2 — Monitoring During Recovery [X] Deploy enhanced monitoring on all recovered systems (verbose logging, network capture, process monitoring) [X] Run full vulnerability scan on all systems in affected VLANs [X] Monitor for re-infection indicators for 72 hours post-recovery Step 6.3 — Service Restoration Priority Priority 1: Active Directory (SRV-DC01, SRV-DC02) Priority 2: File shares (SRV-FILE01) — needed for business operations Priority 3: Print services (SRV-PRINT01) — rebuild with SMBv1 DISABLED Priority 4: Workstations — reimaged and rejoined to domain >>> STUDENT TASK: Define specific success criteria for each priority level. How do you know the system is safe to return to production? SECTION 7: COMMUNICATION PLAN =============================================================================== AUDIENCE WHEN WHAT WHO ------------------ ----------------------- ---------------------------- -------- SOC Team Immediately Alert triage results Tier 1 SOC Manager Within 15 min Incident confirmation Tech Lead CISO Within 30 min Severity, scope, impact IC Legal Within 1 hour Data exposure assessment IC HR Within 2 hours If employee data exposed IC Affected users Within 4 hours Account status, next steps Comms Lead Executive team Within 4 hours Business impact summary CISO Regulators Within 72 hours* If PII/financial data Legal Customers TBD by Legal If customer data affected Comms Lead * GDPR requires notification within 72 hours of becoming aware of a breach involving personal data. Other regulations may have different timelines. >>> STUDENT TASK: Draft a 1-paragraph executive summary suitable for the CISO briefing at the 30-minute mark, based on what is known from the alert feed at 07:30 UTC. SECTION 8: POST-INCIDENT ACTIVITY =============================================================================== [ ] Conduct post-incident review within 5 business days [ ] Document full incident timeline (from initial compromise to containment) [ ] Identify root causes (technical AND process failures) [ ] Create action items with owners and deadlines: - Detection improvements - Architecture changes - Process/playbook updates - Training needs [ ] Update this playbook with lessons learned [ ] Brief leadership on improvements and resource needs [ ] Schedule follow-up assessment in 30 days to verify improvements >>> STUDENT TASK: Write 5 specific lessons learned from this incident and 5 corresponding action items with realistic deadlines. =============================================================================== END OF PLAYBOOK ===============================================================================