===============================================================================
  INCIDENT RESPONSE PLAYBOOK — RANSOMWARE / DATA EXFILTRATION
  Organization: Globex Corporation
  Version: 2.1 (Draft — Gaps Marked for Student Completion)
  Last Reviewed: 2026-02-15
  Playbook Owner: SOC Manager
  Classification: INTERNAL — RESTRICTED
===============================================================================


SECTION 1: DETECTION CRITERIA
===============================================================================

This playbook is activated when ONE or MORE of the following conditions are met:

  [X] EDR alert for known ransomware binary or behavior (file encryption,
      ransom note creation, mass file rename with unusual extension)
  [X] SIEM correlation rule: data staging + large outbound transfer
      (>50 MB to external IP within 30 minutes)
  [X] User report of encrypted files, ransom note on screen, or unusual
      "file access denied" errors across network shares
  [X] IDS/IPS signature match for known ransomware C2 communication
  [X] DLP alert for bulk sensitive data transfer to external destination
  [ ] ________________________________________________________
      (Student: Add one additional detection criterion relevant to
       the scenario in soc-alert-feed.txt)


SECTION 2: SEVERITY CLASSIFICATION
===============================================================================

Classify the incident based on scope and impact:

  SEVERITY 1 (CRITICAL) — Conditions:
    - Active data exfiltration confirmed
    - Ransomware actively encrypting production systems
    - Domain controller compromised
    - More than 10 hosts affected
    Response time: IMMEDIATE (within 15 minutes)
    Notification: CISO, CTO, Legal, Communications, External IR retainer

  SEVERITY 2 (HIGH) — Conditions:
    - Ransomware contained to single host or segment
    - Data staging detected but exfiltration not confirmed
    - Lateral movement detected but privilege escalation not confirmed
    Response time: Within 1 hour
    Notification: SOC Manager, IT Director, Security Team Lead

  SEVERITY 3 (MEDIUM) — Conditions:
    - Suspicious indicators (C2 beacon, encoded PowerShell) on single host
    - No confirmed lateral movement or data access
    Response time: Within 4 hours
    Notification: SOC Manager, Tier 2 Analyst

  >>> STUDENT TASK: Based on the soc-alert-feed.txt scenario, what severity
      would you assign at each of these timestamps? Justify each:
      - At 06:18 (first PowerShell beacon detected)
      - At 06:55 (EternalBlue exploitation)
      - At 07:22 (data exfiltration detected)


SECTION 3: INITIAL RESPONSE (First 30 Minutes)
===============================================================================

Role Assignments:
  Incident Commander:    _________________________________ (assign by name/role)
  Technical Lead:        _________________________________ (assign by name/role)
  Communications Lead:   _________________________________ (assign by name/role)
  Scribe:                _________________________________ (assign by name/role)

Step 3.1 — Confirm the Incident
  [X] Verify the triggering alert is a true positive (not a false positive
      or test). Check raw log data in SIEM.
  [X] Determine: Is this an active, ongoing incident or historical?
  [ ] ________________________________________________________
  [ ] ________________________________________________________
      (Student: Add 2 additional confirmation steps. What would you verify
       to confirm the alert feed scenario is a real attack?)

Step 3.2 — Scope Assessment
  [X] Identify the initially compromised host(s) and user account(s)
  [X] Query SIEM for related alerts in the past 24 hours for the same
      source IP, user, and destination
  [X] Check EDR console for beacon/implant activity on other hosts
  [ ] ________________________________________________________
  [ ] ________________________________________________________
      (Student: Add 2 additional scoping steps. How would you determine
       the full blast radius of this incident?)

Step 3.3 — Preserve Evidence (Before Containment)
  [X] Screenshot active alerts and dashboards
  [X] Export relevant SIEM search results (raw logs) for the incident window
  [ ] ________________________________________________________
  [ ] ________________________________________________________
  [ ] ________________________________________________________
      (Student: Add 3 evidence preservation steps. Think about volatile
       evidence that will be lost once containment actions are taken.)


SECTION 4: CONTAINMENT PROCEDURES
===============================================================================

Step 4.1 — Network Containment
  [X] Isolate compromised host(s) via EDR network isolation
      Command: CrowdStrike > Host Management > Network Containment > Enable
  [X] Add attacker C2 IPs/domains to firewall block list
      IPs to block: _______________________________________________
      Domains to block: ___________________________________________
      (Student: Fill in from the soc-alert-feed.txt)
  [X] Block exfiltration destination IP at edge firewall
      IP to block: ________________________________________________
      (Student: Fill in from the soc-alert-feed.txt)
  [ ] ________________________________________________________
  [ ] ________________________________________________________
      (Student: Add 2 additional network containment actions. Consider
       what other network paths the attacker may use.)

Step 4.2 — Account Containment
  [X] Disable compromised user account(s) in Active Directory
      Accounts to disable: ________________________________________
      (Student: List all compromised accounts from the alert feed)
  [X] Reset passwords for all accounts that authenticated on compromised hosts
  [ ] ________________________________________________________
  [ ] ________________________________________________________
      (Student: Add 2 additional account containment actions. Think about
       service accounts, backdoor accounts, and Kerberos tickets.)

Step 4.3 — Endpoint Containment
  [X] Quarantine malware samples identified by EDR
  [X] Kill malicious processes on compromised hosts
      Processes to kill: __________________________________________
      (Student: List from the alert feed)
  [ ] ________________________________________________________
      (Student: Add 1 additional endpoint containment action)


SECTION 5: ERADICATION CHECKLIST
===============================================================================

Complete ALL items before declaring eradication. Check each box only after
verification.

  [ ] All identified C2 implants/beacons removed from all hosts
      Hosts to clean: ____________________________________________
      (Student: List all hosts with confirmed beacons)

  [ ] All persistence mechanisms removed
      Registry keys: _____________________________________________
      Scheduled tasks: ___________________________________________
      (Student: List specific persistence artifacts from alert feed)

  [ ] All backdoor accounts deleted
      Accounts: __________________________________________________
      (Student: List from alert feed)

  [ ] Compromised credentials rotated
      - Domain admin passwords
      - Service account passwords (especially: _____________________)
      - KRBTGT password (double rotation, 12+ hours apart)
      - Local administrator passwords on all systems

  [ ] Vulnerable systems patched
      - SRV-PRINT01: _____________________________________________
        (Student: Specify the vulnerability and required patch)
      - Any other unpatched hosts identified during investigation

  [ ] Firewall rules tightened
      Rule changes: ______________________________________________
      (Student: Specify at least 3 firewall rule changes from your
       network-topology.txt analysis)

  [ ] SIEM detection rules updated
      New rules: _________________________________________________
      (Student: Specify at least 3 new detection rules from your
       detection-gaps.txt analysis)


SECTION 6: RECOVERY STEPS
===============================================================================

Step 6.1 — System Recovery
  [X] Rebuild compromised hosts from known-good images (do NOT simply
      "clean" — rebuild from scratch)
  [X] Restore data from verified clean backups (verify backup integrity
      and confirm backups pre-date the compromise)
  [X] Verify restored systems are fully patched before reconnecting to network
  [X] Re-enable network connectivity in stages: one host at a time, monitor
      for 30 minutes before connecting the next

Step 6.2 — Monitoring During Recovery
  [X] Deploy enhanced monitoring on all recovered systems (verbose logging,
      network capture, process monitoring)
  [X] Run full vulnerability scan on all systems in affected VLANs
  [X] Monitor for re-infection indicators for 72 hours post-recovery

Step 6.3 — Service Restoration Priority
  Priority 1: Active Directory (SRV-DC01, SRV-DC02)
  Priority 2: File shares (SRV-FILE01) — needed for business operations
  Priority 3: Print services (SRV-PRINT01) — rebuild with SMBv1 DISABLED
  Priority 4: Workstations — reimaged and rejoined to domain

  >>> STUDENT TASK: Define specific success criteria for each priority
      level. How do you know the system is safe to return to production?


SECTION 7: COMMUNICATION PLAN
===============================================================================

AUDIENCE           WHEN                    WHAT                         WHO
------------------ ----------------------- ---------------------------- --------
SOC Team           Immediately             Alert triage results         Tier 1
SOC Manager        Within 15 min           Incident confirmation        Tech Lead
CISO               Within 30 min           Severity, scope, impact      IC
Legal              Within 1 hour           Data exposure assessment     IC
HR                 Within 2 hours          If employee data exposed     IC
Affected users     Within 4 hours          Account status, next steps   Comms Lead
Executive team     Within 4 hours          Business impact summary      CISO
Regulators         Within 72 hours*        If PII/financial data        Legal
Customers          TBD by Legal            If customer data affected    Comms Lead

* GDPR requires notification within 72 hours of becoming aware of a breach
  involving personal data. Other regulations may have different timelines.

  >>> STUDENT TASK: Draft a 1-paragraph executive summary suitable for the
      CISO briefing at the 30-minute mark, based on what is known from the
      alert feed at 07:30 UTC.


SECTION 8: POST-INCIDENT ACTIVITY
===============================================================================

  [ ] Conduct post-incident review within 5 business days
  [ ] Document full incident timeline (from initial compromise to containment)
  [ ] Identify root causes (technical AND process failures)
  [ ] Create action items with owners and deadlines:
      - Detection improvements
      - Architecture changes
      - Process/playbook updates
      - Training needs
  [ ] Update this playbook with lessons learned
  [ ] Brief leadership on improvements and resource needs
  [ ] Schedule follow-up assessment in 30 days to verify improvements

  >>> STUDENT TASK: Write 5 specific lessons learned from this incident
      and 5 corresponding action items with realistic deadlines.

===============================================================================
  END OF PLAYBOOK
===============================================================================
