Guide · Agent skill
How to use the Ransomware SOC Playbook Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Ransomware SOC Playbook Builder is an agent skill, a packaged set of instructions and files that an AI agent such as Claude loads when it recognises a matching task. This guide explains what the building-soc-playbook-for-ransomware skill does, how to install it, how to ask for it in plain language, and where its limits are. By the end you will know how to get a draft ransomware response playbook from the agent and how to check it before anyone relies on it.
Ransomware SOC Playbook Buildermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the skill's ZIP file from this directory page.
- 2Install the skill. Unzip into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 3Check prerequisites. Confirm you have a SIEM, an EDR with isolation capability and tested backups, and Python 3 with requests if you plan to run the helper.
- 4Ask in plain language. Request a ransomware SOC playbook aligned to NIST SP 800-61 and MITRE ATT&CK, naming your SIEM and EDR.
- 5Review the output. Check every query, command and decision branch against your own environment before adoption.
- 6Test in a non-production environment. Run detection queries and tabletop exercises against non-production systems first.
What the skill makes the agent do
Once installed, the agent can produce a step-by-step ransomware response playbook for a security operations centre. The playbook is organised into detection, containment, evidence collection, eradication and recovery, and it is aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
The skill's source material includes example SIEM detection queries for Splunk and Elastic Security, a triage decision tree, and sample commands for isolating hosts through CrowdStrike Falcon, Microsoft Defender for Endpoint, or a firewall. It also includes an optional Python helper that can check ransomware samples against public identification and malware hash services.
- Detection: Splunk SPL and Elastic EQL queries for mass file encryption, shadow copy deletion (T1490) and ransom note creation
- Triage: a decision tree that asks whether encryption is active, how many hosts are affected and whether exfiltration is confirmed
- Containment: example EDR isolation API calls, a firewall rule to block SMB spread, and Active Directory emergency actions
- Evidence and recovery: example forensic collection commands and a backup-based recovery checklist
Install the skill on Claude Code or the Claude apps
Download the skill's ZIP file from this directory page. Unzip it into your personal skills folder at ~/.claude/skills/ so it is available in every project, or into a project's .claude/skills/ folder so it is available only there.
In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills. Choose whichever route fits how your team works.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Ask for the playbook in plain language
You do not need to type the skill name. The skill's description says it should be used when SOC teams need formalised response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK. Requests that name those concepts are the most likely to load it.
Be specific about your environment. Mention your SIEM (Splunk ES, Elastic Security or Sentinel), your EDR (CrowdStrike, SentinelOne or Microsoft Defender for Endpoint) and your audience, such as Tier 1-3 analysts or a tabletop exercise team.
- "Draft a ransomware SOC playbook aligned to NIST SP 800-61 for our Tier 1-3 analysts. We use Splunk ES and CrowdStrike."
- "Build a triage decision tree for ransomware alerts, with isolation steps for single, multi-host and enterprise-wide cases."
- "Write Elastic EQL detections for shadow copy deletion and ransom note creation."
- "Give me a ransomware evidence collection checklist for Windows hosts before we reimage them."
What you need before you run anything
The skill's prerequisites assume you already have a SIEM with endpoint and network data, an EDR with network isolation capability, backups with tested recovery procedures, and a communication plan with legal, leadership and any external incident response contacts. Without those, the playbook will describe steps your team cannot carry out.
The optional helper script, scripts/agent.py, requires Python 3 with the requests library. Its reference notes list requests version 2.28 or later. The script takes an incident ID and can optionally take a sample file, a CrowdStrike device ID and token, and Splunk connection details. Running the helper also requires internet access to ID Ransomware, No More Ransom and MalwareBazaar.
- Python 3 with the requests library (for scripts/agent.py)
- Access to a SIEM and EDR for the referenced procedures
- CrowdStrike or Microsoft Defender API tokens, only if you use the isolation commands
- Internet access to ID Ransomware, No More Ransom and MalwareBazaar, only if you run the helper
python agent.py --incident-id IR-2024-0500 --sample encrypted_file.locked --device-id <device_id> --cs-token <token> --splunk-url https://splunk:8089 --splunk-key <key>Safety: read the scripts and the commands before use
The skill runs scripts and uses the network. The helper calls external services and can call CrowdStrike and Splunk APIs with credentials you supply. Read scripts/agent.py before you run it, use test credentials first, and never run it with production tokens until you understand what each call does.
The generated commands are generic examples, not a vetted runbook. Some are disruptive. The skill's own warnings say the Kerberos reset in its Active Directory section resets the krbtgt account and needs two resets 12 or more hours apart, and that host isolation and account changes can cause outages if run without review. Treat every command as a draft to validate in your own environment, and do not use the skill as the only guide during a live incident.
- Read scripts/agent.py and references/api-reference.md before running anything
- Use test accounts and non-production tokens first
- Validate every query and command against your own SIEM, EDR and domain setup
- Keep the skill out of live response as the sole guide; rehearse playbooks beforehand
Tips for getting a usable draft
Ask for one phase at a time. A focused request such as only the detection layer produces more checkable output than a request for the whole playbook at once. Then ask for the next phase.
Give the agent your own names: your SIEM index names, EDR platform, backup product and escalation tiers. Replace the placeholder values in the generated queries, such as the KNOWN_HASH and C2_IP_ADDRESS fields in the IOC scan, before you test anything.
- Request one phase at a time and review each before moving on
- Replace placeholders like KNOWN_HASH and C2_IP_ADDRESS with real values from your environment
- Test detection queries in a non-production SIEM first
- Have your legal and leadership contacts review the communication steps
What people use it for
- Drafting a ransomware response procedure for Tier 1-3 analysts at a security operations centre
- Updating an existing playbook with Elastic EQL or Splunk detections for shadow copy deletion
- Preparing documented incident playbooks for NIST CSF or ISO 27001 compliance audits
- Creating a starting draft for a tabletop exercise to test against
Frequently asked questions
How do I install the building-soc-playbook-for-ransomware skill?
Download the skill's ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
What do I need to run this skill?
You need a SIEM such as Splunk ES, Elastic Security or Sentinel, and an EDR such as CrowdStrike, SentinelOne or Microsoft Defender for Endpoint. The optional helper script needs Python 3 with the requests library and internet access to ID Ransomware, No More Ransom and MalwareBazaar.
Is the skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. Check the licence file in the download for the full terms.
Can I use this skill during an active ransomware attack?
No, not as your only guide. The skill itself warns against this, and its commands, such as host isolation and Kerberos key resets, can cause outages if run without review. Use pre-built, rehearsed playbooks during live response.
Are the SIEM queries and isolation commands ready to run?
No. They are generic examples that contain placeholder values such as KNOWN_HASH and C2_IP_ADDRESS. Validate them against your own environment and test them in a non-production system first.
How is this different from writing a playbook by hand?
The skill gives the agent a structured starting draft covering detection, containment, evidence, eradication and recovery, with example queries for Splunk and Elastic. It does not replace expert review, local testing or your team's knowledge of its own systems.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security teams drafting or updating ransomware response procedures, teams preparing documented playbooks for audits, and tabletop facilitators who need a starting draft. It is a poor fit for live incident response, for small teams without SIEM, EDR and tested backups, or for anyone expecting a vetted playbook without their own validation.
Download the skill