version: "1.0.0" name: ir-playbook-ransomware description: Incident-response playbook for ransomware — mass file modification/encryption, ransom notes, shadow-copy and backup deletion, service stopping and log clearing; use when Wazuh shows FIM bursts (rules 550, 553, 554), antimalware detections (rules 62113, 87105), audit-log clearing (rule 60117) or recovery-inhibition commands. Containment within minutes. allowed-tools: get_wazuh_alerts search_security_events get_wazuh_agents check_agent_health get_agent_processes get_agent_ports get_case search_cases update_case add_entities link_mitre add_finding list_actions wazuh_check_agent_isolation wazuh_check_process wazuh_check_file_quarantine wazuh_check_user_status wazuh_check_blocked_ip metadata: category: response display_name: IR Playbook — Ransomware standards: [nist-800-61r3, sans-picerl, mitre-attack, mitre-d3fend, nist-csf-2, iso-27001-2022, cis-v8-1] version: "2.1"

IR Playbook — Ransomware

Severity critical. Speed matters more than completeness: isolate within 5 minutes of confirmation, scope within 30 minutes. MITRE ATT&CK: T1486 (encrypted for impact), T1490 (inhibit recovery), T1489 (service stop), T1070.001 (log clearing), T1567 (pre-encryption exfil). Rule IDs are from the stock Wazuh 4.14 ruleset (levels official). Full procedure and family indicators: references/playbook.md.

1. Detection signals

Stock gaps — the org must create these (range 100000–120000, validate with wazuh-logtest):

• Mass FIM burst: custom rule 100401 — frequency ≥ 100 over group syscheck in 60 s, <same_field>agent.id</same_field>.
• Ransom-note / encrypted-extension creation: custom rule 100402 — syscheck.path matching note names

(README*.txt, *DECRYPT*, *RESTORE*) or known extensions.

• Recovery inhibition: custom rule 100403 — Sysmon Event ID 1 commandLine matching vssadmin.*delete shadows,

wmic shadowcopy delete, bcdedit.*recoveryenabled no, wbadmin delete catalog. The stock ruleset has no rule for these commands; treat them as critical.

• Backup / VSS service stopped: custom rule 100404 on System-log Event ID 7036/7040 for VSS and backup agents.

Treat any ransom note as confirmation. Mass FIM changes from a known backup/sync/deployment job → confirm with the owner before acting and tune the rule.

2. Triage / investigation (investigation agent, ≤ 5 minutes)

1. get_wazuh_alerts for the host (agent_id, timestamp_start: "now-1h", rule_groups: ["syscheck","windows_defender","sysmon_eid11_detections"]);

search_cases — part of an open incident?

1. Answer fast: encryption active (FIM volume still rising)? Which hosts? Ransom note? Recovery inhibition

seen? Which account runs the encrypting process (get_agent_processes)?

1. add_entities (hosts with agent_id, account, process, note/file paths, external IPs), link_mitre

T1486/T1490, update_case severity critical.

1. If encryption is active, add_finding with an immediate containment recommendation to response-planner

(host, process id, file path) — skip deep correlation until containment is proposed.

1. Then scope (≤ 30 min): search_security_events for the same hash/process/FIM bursts fleet-wide; agents that went

silent (get_wazuh_agents with status: "disconnected", check_agent_health); neighbours of patient zero with get_agent_processes / get_agent_ports for lateral-movement precursors (PsExec, WMI, RDP) and pre-encryption exfil (rclone, large uploads). Hand off to threat-intel for family/TTPs and IOC reputation, and run ir-playbook-lateral-movement / ir-playbook-data-exfiltration in parallel where indicated.

3. Response (response-planner)

Isolation defaults to supervised; flag urgency in the rationale so approvers act within minutes. Check wazuh_check_agent_isolation before re-proposing. Do not propose restarting encrypted hosts (memory evidence and keys can be lost). Segmentation beyond Wazuh active response, backup lockdown and domain account resets are human tasks — record them with add_finding and owners.

4. Eradication and recovery

• Rebuild affected hosts; restore from offline/immutable backups verified clean.
• Reset credentials domain-wide if domain accounts were used; hunt persistence before reconnecting.
• Un-isolate only after verification and owner sign-off (rollback in the approvals UI).
• No payment or actor contact without an executive/legal decision (record in findings only).

5. Verification

The responder verifies each executed action (wazuh_check_agent_isolation, wazuh_check_process, wazuh_check_file_quarantine, wazuh_check_user_status, wazuh_check_blocked_ip).

6. Evidence and records

• Preserve ransom notes, sample encrypted files, binary hashes, process trees (ISO 27001 A.5.28).
• Findings with standard_refs: MITRE-ATTACK:T1486, MITRE-ATTACK:T1490, NIST-800-61r3:Respond,

SANS-PICERL:Containment, NIST-CSF-2:RS.MI.

• Hand off to reporting for the executive BLUF and incident report; hand off to detection-engineer for the

custom rules above if they are missing.

Escalation