[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG0S7RWPK8YM1615F9TM7G":3,"skill-same:01M6AG0S7RWPK8YM1615F9TM7G":145},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6AG0S7RWPK8YM1615F9TM7G","performing-ransomware-tabletop-exercise",null,"Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat actors like LockBit and ALPHV\u002FBlackCat with injects covering double extortion and backup destruction, then evaluates responses against NIST CSF and CISA guidelines. Use when planning or running a ransomware tabletop exercise or incident response readiness drill.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing ransomware tabletop exercise","ransomware","NIST","preparedness","tabletop-exercise","csf","backup","t1490","t1059","t1078","defense","cybersecurity","CISA","cryptocurrency","extortion","nist csf","planning","guidelines","pr","incident response","2026-11-10 10:12:30",false,"---\nname: performing-ransomware-tabletop-exercise\ndescription: 'Plans and facilitates tabletop exercises simulating ransomware incidents,\n  using realistic scenarios based on threat actors like LockBit and ALPHV\u002FBlackCat\n  with injects covering double extortion and backup destruction, then evaluates responses\n  against NIST CSF and CISA guidelines. Use when planning or running a ransomware\n  tabletop exercise or incident response readiness drill.\n\n  '\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- incident-response\n- tabletop-exercise\n- defense\n- preparedness\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1486\n- T1490\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - monetization\n  techniques:\n  - id: T1531\n    name: Account Access Removal\n    tactic: positioning\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n  - id: F1017.001\n    name: 'Conversion to Physical Monetary Instruments: Cash'\n    tactic: monetization\n    source: f3\n---\n# Performing Ransomware Tabletop Exercise\n\n## When to Use\n\n- Testing organizational ransomware response procedures annually or after major infrastructure changes\n- Validating decision-making processes for ransom payment, regulatory notification, and public disclosure\n- Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident\n- Meeting cyber insurance policy requirements for documented incident response testing\n- Identifying gaps in recovery playbooks, communication plans, and backup procedures\n\n**Do not use** as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.\n\n## Prerequisites\n\n- Documented incident response plan (IRP) that participants should have read before the exercise\n- Identified exercise participants from: executive leadership, IT\u002Fsecurity, legal, communications\u002FPR, HR, operations, and external counsel\n- Facilitator who is independent from the IR team (to provide objective evaluation)\n- Ransomware scenario designed with injects that escalate over multiple rounds\n- Evaluation criteria aligned to NIST CSF Respond\u002FRecover functions\n- Conference room or virtual meeting for 2-4 hours with no interruptions\n\n## Workflow\n\n### Step 1: Design the Exercise Scenario\n\nBuild a realistic scenario based on current threat actor TTPs:\n\n**Scenario Structure:**\n```\nPhase 1: Initial Detection (30 min)\n  - SOC receives alert for suspicious process execution on file server\n  - EDR detects Cobalt Strike beacon on 3 workstations\n  - Inject: External threat intel report links C2 IP to LockBit affiliate\n\nPhase 2: Escalation (30 min)\n  - Ransomware executes on 40% of servers during overnight hours\n  - Ransom note demands $2M in Bitcoin with 72-hour deadline\n  - Inject: Attackers contact media claiming data theft of customer PII\n\nPhase 3: Decision Points (45 min)\n  - Backup assessment reveals immutable copies are intact but primary backups encrypted\n  - Legal advises on breach notification timeline (72 hours GDPR, varies by US state)\n  - Inject: Threat actor publishes sample of stolen data on leak site\n\nPhase 4: Recovery and Communication (45 min)\n  - Recovery time estimate: 5-7 days from immutable backups\n  - Insurance carrier engages negotiation firm\n  - Inject: Major customer threatens contract termination without update within 24 hours\n```\n\n**Scenario Variables to Customize:**\n- Threat actor group and known TTPs\n- Percentage of infrastructure encrypted\n- Whether backups are intact, partially compromised, or fully destroyed\n- Type of data exfiltrated (PII, PHI, financial, trade secrets)\n- Applicable regulatory frameworks (GDPR, HIPAA, PCI DSS, SEC rules)\n- Ransom amount and payment deadline\n\n### Step 2: Prepare Exercise Materials\n\nCreate the following documents for participants:\n\n1. **Exercise Overview Briefing** - Ground rules, objectives, scope, and participants\n2. **Situation Reports (SITREPs)** - One per phase, distributed as the exercise progresses\n3. **Inject Cards** - New information introduced at specific times to force decision-making\n4. **Decision Point Worksheets** - Structured forms for documenting group decisions\n5. **Evaluation Scorecard** - Criteria for assessing response quality\n\n**Key Decision Points to Include:**\n- When to activate the incident response team\n- Whether to shut down systems or contain selectively\n- Whether to engage law enforcement (FBI IC3, CISA)\n- Whether to pay the ransom and under what conditions\n- When and how to notify regulators, customers, and the public\n- How to prioritize system recovery order\n\n### Step 3: Facilitate the Exercise\n\n**Facilitator Responsibilities:**\n- Present each phase scenario and distribute SITREPs\n- Introduce injects at predetermined times to increase pressure\n- Ask probing questions to test decision-making reasoning\n- Ensure all participant groups contribute (prevent IT from dominating)\n- Document all decisions, rationales, and action items\n- Track time management (many teams lose time on early phases)\n\n**Probing Questions by Phase:**\n\nPhase 1 - Detection:\n- Who makes the call to declare an incident? What criteria trigger it?\n- How do we determine the scope of compromise from initial alerts?\n- Do we have the forensic capability to investigate or do we need external help?\n\nPhase 2 - Escalation:\n- What is our communication plan for employees? Do they know not to turn on affected machines?\n- Have we isolated the network to prevent further encryption?\n- Who authorizes system shutdowns that impact business operations?\n\nPhase 3 - Decision:\n- Under what conditions would we consider paying the ransom?\n- What are the legal obligations for notification at this point?\n- How do we handle the public leak of customer data?\n\nPhase 4 - Recovery:\n- What is the recovery priority order? Is it documented or decided ad hoc?\n- How long until critical business operations resume?\n- What evidence preservation is required for law enforcement and insurance?\n\n### Step 4: Evaluate and Score Responses\n\nScore each functional area against defined criteria:\n\n| Evaluation Area | Score (1-5) | Criteria |\n|----------------|-------------|----------|\n| Detection & Escalation | | Timely incident declaration, proper chain of command |\n| Containment | | Network isolation, credential reset, scope assessment |\n| Communication - Internal | | Employee notification, executive briefing, documented decisions |\n| Communication - External | | Regulatory notification, customer communication, media response |\n| Recovery Planning | | Backup verification, recovery priority, RTO tracking |\n| Legal & Compliance | | Breach notification timelines, evidence preservation, law enforcement engagement |\n| Business Continuity | | Manual operations, customer impact mitigation, revenue loss estimation |\n| Payment Decision | | Structured framework, legal review, OFAC sanctions check |\n\n### Step 5: Document Findings and Remediation Plan\n\nProduce an after-action report (AAR) within 5 business days:\n\n**AAR Contents:**\n1. Exercise overview and objectives\n2. Scenario summary and injects\n3. Key decisions made and rationale\n4. Strengths observed\n5. Gaps identified with severity rating\n6. Remediation actions with owners and deadlines\n7. Comparison to previous exercise results (if applicable)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Tabletop Exercise (TTX)** | Discussion-based exercise where participants walk through a simulated incident scenario to test plans and procedures |\n| **Inject** | New information introduced during the exercise to change the scenario and force additional decision-making |\n| **SITREP** | Situation Report providing current status of the simulated incident at each exercise phase |\n| **After-Action Report (AAR)** | Post-exercise document capturing findings, gaps, strengths, and remediation actions |\n| **Double Extortion** | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless ransom is paid |\n| **OFAC Check** | Verification that ransom payment recipient is not on the US Treasury OFAC sanctions list, which would make payment illegal |\n\n## Tools & Systems\n\n- **CISA Tabletop Exercise Packages (CTEPs)**: Free scenario packages from CISA designed for critical infrastructure sectors\n- **FEMA Homeland Security Exercise and Evaluation Program (HSEEP)**: Methodology for designing, conducting, and evaluating exercises\n- **Immersive Labs**: Platform providing interactive cyber crisis simulations with real-time scoring\n- **Tabletop Scenarios (from NCSC UK)**: Exercise in a Box tool providing free guided tabletop exercises\n- **Ransomware Readiness Assessment (CISA)**: Self-assessment tool for evaluating ransomware preparedness\n\n## Common Scenarios\n\n### Scenario: Healthcare System Double Extortion Exercise\n\n**Context**: A 5-hospital healthcare system conducts an annual ransomware tabletop. Previous exercise revealed gaps in HIPAA breach notification and clinical system recovery priority. This year's scenario simulates a double extortion attack targeting the EMR system.\n\n**Approach**:\n1. Design scenario based on Cl0p MOO (Managed Operations Operator) TTPs: exploitation of MOVEit vulnerability for initial access, data exfiltration of 500,000 patient records, followed by encryption of EMR database servers\n2. Participants: CISO, CIO, CMO (Chief Medical Officer), General Counsel, VP Communications, Director of Clinical Operations, Privacy Officer, External IR firm representative\n3. Phase 1 inject: EMR system down, emergency department diverting patients to neighboring hospital\n4. Phase 2 inject: HHS OCR (Office for Civil Rights) contacts organization about reports of patient data on dark web\n5. Phase 3 inject: Attacker provides decryption key sample for $3.5M, 48-hour deadline\n6. Key finding: Organization lacks documented criteria for ransom payment decision and had not pre-identified an OFAC-compliant payment mechanism\n7. Remediation: Establish payment decision framework, pre-engage ransomware negotiation firm, update HIPAA breach notification procedures with specific timelines\n\n**Pitfalls**:\n- Designing unrealistic scenarios that do not reflect actual ransomware TTPs, reducing exercise credibility\n- Allowing technical teams to dominate the exercise while business and legal participants remain passive\n- Not testing the communication plan (many organizations discover their notification list is outdated during the actual incident)\n- Failing to follow up on remediation actions identified in the AAR, negating the exercise value\n\n## Output Format\n\n```\n## Ransomware Tabletop Exercise - After Action Report\n\n**Exercise Date**: [Date]\n**Facilitator**: [Name]\n**Scenario**: [Brief description]\n**Duration**: [Hours]\n**Participants**: [Count by department]\n\n### Exercise Objectives\n1. [Objective] - Met \u002F Partially Met \u002F Not Met\n2. [Objective] - Met \u002F Partially Met \u002F Not Met\n\n### Key Decisions Log\n| Time | Decision Point | Decision Made | Rationale | Assessment |\n|------|---------------|--------------|-----------|------------|\n\n### Strengths Observed\n1. [Strength]\n\n### Gaps Identified\n| Gap | Severity | Affected Area | Current State | Desired State |\n|-----|----------|--------------|---------------|---------------|\n\n### Remediation Actions\n| Action | Owner | Deadline | Priority | Status |\n|--------|-------|----------|----------|--------|\n\n### Comparison to Previous Exercise\n| Area | Previous Score | Current Score | Trend |\n|------|---------------|--------------|-------|\n```\n","# Performing Ransomware Tabletop Exercise\n\n## When to Use\n\n- Testing organizational ransomware response procedures annually or after major infrastructure changes\n- Validating decision-making processes for ransom payment, regulatory notification, and public disclosure\n- Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident\n- Meeting cyber insurance policy requirements for documented incident response testing\n- Identifying gaps in recovery playbooks, communication plans, and backup procedures\n\n**Do not use** as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.\n\n## Prerequisites\n\n- Documented incident response plan (IRP) that participants should have read before the exercise\n- Identified exercise participants from: executive leadership, IT\u002Fsecurity, legal, communications\u002FPR, HR, operations, and external counsel\n- Facilitator who is independent from the IR team (to provide objective evaluation)\n- Ransomware scenario designed with injects that escalate over multiple rounds\n- Evaluation criteria aligned to NIST CSF Respond\u002FRecover functions\n- Conference room or virtual meeting for 2-4 hours with no interruptions\n\n## Workflow\n\n### Step 1: Design the Exercise Scenario\n\nBuild a realistic scenario based on current threat actor TTPs:\n\n**Scenario Structure:**\n```\nPhase 1: Initial Detection (30 min)\n  - SOC receives alert for suspicious process execution on file server\n  - EDR detects Cobalt Strike beacon on 3 workstations\n  - Inject: External threat intel report links C2 IP to LockBit affiliate\n\nPhase 2: Escalation (30 min)\n  - Ransomware executes on 40% of servers during overnight hours\n  - Ransom note demands $2M in Bitcoin with 72-hour deadline\n  - Inject: Attackers contact media claiming data theft of customer PII\n\nPhase 3: Decision Points (45 min)\n  - Backup assessment reveals immutable copies are intact but primary backups encrypted\n  - Legal advises on breach notification timeline (72 hours GDPR, varies by US state)\n  - Inject: Threat actor publishes sample of stolen data on leak site\n\nPhase 4: Recovery and Communication (45 min)\n  - Recovery time estimate: 5-7 days from immutable backups\n  - Insurance carrier engages negotiation firm\n  - Inject: Major customer threatens contract termination without update within 24 hours\n```\n\n**Scenario Variables to Customize:**\n- Threat actor group and known TTPs\n- Percentage of infrastructure encrypted\n- Whether backups are intact, partially compromised, or fully destroyed\n- Type of data exfiltrated (PII, PHI, financial, trade secrets)\n- Applicable regulatory frameworks (GDPR, HIPAA, PCI DSS, SEC rules)\n- Ransom amount and payment deadline\n\n### Step 2: Prepare Exercise Materials\n\nCreate the following documents for participants:\n\n1. **Exercise Overview Briefing** - Ground rules, objectives, scope, and participants\n2. **Situation Reports (SITREPs)** - One per phase, distributed as the exercise progresses\n3. **Inject Cards** - New information introduced at specific times to force decision-making\n4. **Decision Point Worksheets** - Structured forms for documenting group decisions\n5. **Evaluation Scorecard** - Criteria for assessing response quality\n\n**Key Decision Points to Include:**\n- When to activate the incident response team\n- Whether to shut down systems or contain selectively\n- Whether to engage law enforcement (FBI IC3, CISA)\n- Whether to pay the ransom and under what conditions\n- When and how to notify regulators, customers, and the public\n- How to prioritize system recovery order\n\n### Step 3: Facilitate the Exercise\n\n**Facilitator Responsibilities:**\n- Present each phase scenario and distribute SITREPs\n- Introduce injects at predetermined times to increase pressure\n- Ask probing questions to test decision-making reasoning\n- Ensure all participant groups contribute (prevent IT from dominating)\n- Document all decisions, rationales, and action items\n- Track time management (many teams lose time on early phases)\n\n**Probing Questions by Phase:**\n\nPhase 1 - Detection:\n- Who makes the call to declare an incident? What criteria trigger it?\n- How do we determine the scope of compromise from initial alerts?\n- Do we have the forensic capability to investigate or do we need external help?\n\nPhase 2 - Escalation:\n- What is our communication plan for employees? Do they know not to turn on affected machines?\n- Have we isolated the network to prevent further encryption?\n- Who authorizes system shutdowns that impact business operations?\n\nPhase 3 - Decision:\n- Under what conditions would we consider paying the ransom?\n- What are the legal obligations for notification at this point?\n- How do we handle the public leak of customer data?\n\nPhase 4 - Recovery:\n- What is the recovery priority order? Is it documented or decided ad hoc?\n- How long until critical business operations resume?\n- What evidence preservation is required for law enforcement and insurance?\n\n### Step 4: Evaluate and Score Responses\n\nScore each functional area against defined criteria:\n\n| Evaluation Area | Score (1-5) | Criteria |\n|----------------|-------------|----------|\n| Detection & Escalation | | Timely incident declaration, proper chain of command |\n| Containment | | Network isolation, credential reset, scope assessment |\n| Communication - Internal | | Employee notification, executive briefing, documented decisions |\n| Communication - External | | Regulatory notification, customer communication, media response |\n| Recovery Planning | | Backup verification, recovery priority, RTO tracking |\n| Legal & Compliance | | Breach notification timelines, evidence preservation, law enforcement engagement |\n| Business Continuity | | Manual operations, customer impact mitigation, revenue loss estimation |\n| Payment Decision | | Structured framework, legal review, OFAC sanctions check |\n\n### Step 5: Document Findings and Remediation Plan\n\nProduce an after-action report (AAR) within 5 business days:\n\n**AAR Contents:**\n1. Exercise overview and objectives\n2. Scenario summary and injects\n3. Key decisions made and rationale\n4. Strengths observed\n5. Gaps identified with severity rating\n6. Remediation actions with owners and deadlines\n7. Comparison to previous exercise results (if applicable)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Tabletop Exercise (TTX)** | Discussion-based exercise where participants walk through a simulated incident scenario to test plans and procedures |\n| **Inject** | New information introduced during the exercise to change the scenario and force additional decision-making |\n| **SITREP** | Situation Report providing current status of the simulated incident at each exercise phase |\n| **After-Action Report (AAR)** | Post-exercise document capturing findings, gaps, strengths, and remediation actions |\n| **Double Extortion** | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless ransom is paid |\n| **OFAC Check** | Verification that ransom payment recipient is not on the US Treasury OFAC sanctions list, which would make payment illegal |\n\n## Tools & Systems\n\n- **CISA Tabletop Exercise Packages (CTEPs)**: Free scenario packages from CISA designed for critical infrastructure sectors\n- **FEMA Homeland Security Exercise and Evaluation Program (HSEEP)**: Methodology for designing, conducting, and evaluating exercises\n- **Immersive Labs**: Platform providing interactive cyber crisis simulations with real-time scoring\n- **Tabletop Scenarios (from NCSC UK)**: Exercise in a Box tool providing free guided tabletop exercises\n- **Ransomware Readiness Assessment (CISA)**: Self-assessment tool for evaluating ransomware preparedness\n\n## Common Scenarios\n\n### Scenario: Healthcare System Double Extortion Exercise\n\n**Context**: A 5-hospital healthcare system conducts an annual ransomware tabletop. Previous exercise revealed gaps in HIPAA breach notification and clinical system recovery priority. This year's scenario simulates a double extortion attack targeting the EMR system.\n\n**Approach**:\n1. Design scenario based on Cl0p MOO (Managed Operations Operator) TTPs: exploitation of MOVEit vulnerability for initial access, data exfiltration of 500,000 patient records, followed by encryption of EMR database servers\n2. Participants: CISO, CIO, CMO (Chief Medical Officer), General Counsel, VP Communications, Director of Clinical Operations, Privacy Officer, External IR firm representative\n3. Phase 1 inject: EMR system down, emergency department diverting patients to neighboring hospital\n4. Phase 2 inject: HHS OCR (Office for Civil Rights) contacts organization about reports of patient data on dark web\n5. Phase 3 inject: Attacker provides decryption key sample for $3.5M, 48-hour deadline\n6. Key finding: Organization lacks documented criteria for ransom payment decision and had not pre-identified an OFAC-compliant payment mechanism\n7. Remediation: Establish payment decision framework, pre-engage ransomware negotiation firm, update HIPAA breach notification procedures with specific timelines\n\n**Pitfalls**:\n- Designing unrealistic scenarios that do not reflect actual ransomware TTPs, reducing exercise credibility\n- Allowing technical teams to dominate the exercise while business and legal participants remain passive\n- Not testing the communication plan (many organizations discover their notification list is outdated during the actual incident)\n- Failing to follow up on remediation actions identified in the AAR, negating the exercise value\n\n## Output Format\n\n```\n## Ransomware Tabletop Exercise - After Action Report\n\n**Exercise Date**: [Date]\n**Facilitator**: [Name]\n**Scenario**: [Brief description]\n**Duration**: [Hours]\n**Participants**: [Count by department]\n\n### Exercise Objectives\n1. [Objective] - Met \u002F Partially Met \u002F Not Met\n2. [Objective] - Met \u002F Partially Met \u002F Not Met\n\n### Key Decisions Log\n| Time | Decision Point | Decision Made | Rationale | Assessment |\n|------|---------------|--------------|-----------|------------|\n\n### Strengths Observed\n1. [Strength]\n\n### Gaps Identified\n| Gap | Severity | Affected Area | Current State | Desired State |\n|-----|----------|--------------|---------------|---------------|\n\n### Remediation Actions\n| Action | Owner | Deadline | Priority | Status |\n|--------|-------|----------|----------|--------|\n\n### Comparison to Previous Exercise\n| Area | Previous Score | Current Score | Trend |\n|------|---------------|--------------|-------|\n```\n",{"name":5,"tags":49,"author":51,"domain":35,"license":15,"version":52,"mitre_f3":53,"nist_csf":73,"subdomain":78,"description":79,"mitre_attack":80},[25,50,28,34,27],"incident-response","mahipal","1.0.0",{"tactics":54,"version":57,"techniques":58},[55,56],"positioning","monetization","1.1",[59,63,67,70],{"id":60,"name":61,"source":62,"tactic":55},"T1531","Account Access Removal","attack",{"id":64,"name":65,"source":66,"tactic":56},"F1018","Convert to Cryptocurrency","f3",{"id":68,"name":69,"source":66,"tactic":56},"F1047","Transfer of funds",{"id":71,"name":72,"source":66,"tactic":56},"F1017.001","Conversion to Physical Monetary Instruments: Cash",[74,75,76,77],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense","Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat actors like LockBit and ALPHV\u002FBlackCat with injects covering double extortion and backup destruction, then evaluates responses against NIST CSF and CISA guidelines. Use when planning or running a ransomware tabletop exercise or incident response readiness drill.\n",[81,82,83,84,85],"T1078","T1190","T1059","T1486","T1490","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-ransomware-tabletop-exercise",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ransomware-tabletop-exercise",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ransomware-tabletop-exercise",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ransomware-tabletop-exercise","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002FSKILL.md",true,[110,116,121,127,131,135,141],{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"assets\u002Ftemplate.md","ASSET","资产文件",2271,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002Fassets\u002Ftemplate.md",{"path":117,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002FLICENSE",{"path":122,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Fapi-reference.md","REFERENCE","参考文档",2618,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002Freferences\u002Fapi-reference.md",{"path":128,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fstandards.md",2203,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002Freferences\u002Fstandards.md",{"path":132,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fworkflows.md",3179,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002Freferences\u002Fworkflows.md",{"path":136,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fagent.py","SCRIPT","脚本",6602,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002Fscripts\u002Fagent.py",{"path":142,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Fprocess.py",23048,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ransomware-tabletop-exercise\u002Fscripts\u002Fprocess.py",[146,171,195,217,243,268],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[152],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,155,156,157,158,35,43,159,42,160,161,162,163,164,165,166,167,168,169,170],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[177],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[179,167,180,181,158,182,35,42,183,184,185,186,187,188,189,190,191,192,193,194],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":205,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[201,204],{"categoryNo":202,"categoryName":203,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,30,206,207,208,35,209,210,183,211,212,50,25,37,213,33,31,214,215,216],"recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","detection","immutable","disaster-recovery","restore-testing",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[223],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,35,228,229,230,231,232,233,234,235,236,237,238,239,186,240,241,242],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[251,252,253,35,254,40,36,255,256,257,258,259,260,261,262,263,264,265,266,267],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":269,"name":270,"nameZh":6,"description":271,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":272,"categories":273,"keywords":275,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[274],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,276,35,277,278,279,280,281,26,282,283,33,284,31,285,286,287,288,289,290],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]