Ransomware SOC Playbook Builder
Drafts a structured ransomware incident response playbook with SIEM queries, isolation steps and triage decision trees.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can produce a step-by-step ransomware response playbook for a security operations centre, organised into detection, containment, evidence collection, eradication and recovery, aligned to NIST SP 800-61 and MITRE ATT&CK. It supplies example SIEM detection queries (Splunk and Elastic), a triage decision tree, and sample commands for isolating hosts through CrowdStrike, Microsoft Defender or a firewall. It also includes an optional Python helper that can check ransomware samples against public ransomware identification and malware hash services.
Great for
- Security teams writing or updating ransomware response procedures for Tier 1-3 analysts
- Organisations preparing for compliance audits (NIST CSF, ISO 27001) that require documented incident playbooks
- Tabletop exercise facilitators who need a starting draft to test against
Skip it if
- Responding live to an active ransomware attack: the skill itself warns not to use it as the sole guide, and its commands (such as domain-wide Kerberos key resets or host isolation) can cause outages if run without review
- Non-security staff or small teams without SIEM, EDR and tested backups, since the prerequisites assume those tools exist
- Anyone expecting a vetted, tested playbook: the commands and queries are generic examples that must be validated against the organisation's own environment
Try asking
- “Build a ransomware incident response playbook for our Tier 1-3 SOC aligned to NIST SP 800-61”
- “Write Splunk and Elastic detection rules for shadow copy deletion and ransomware note creation”
- “Create a triage decision tree for ransomware alerts based on host count and data exfiltration”
- “Draft evidence collection steps for a host suspected of ransomware infection before remediation”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-soc-playbook-for-ransomware.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-soc-playbook-for-ransomware.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-soc-playbook-for-ransomware.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Treat all generated commands, queries and firewall rules as drafts; test them in a lab and adapt field names and paths to your own SIEM and EDR before use.
- Do not upload real victim files or sensitive samples to the public services in scripts/agent.py without approval from legal and incident response leads, since uploads leave your network.
- Review scripts/agent.py before running it, and never place API keys or tokens in shared prompts or the script itself.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.