[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG6EC1AA9ERA1PWEP324AP":3,"skill-same:01M6AG6EC1AA9ERA1PWEP324AP":142},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":85,"commitSha":86,"skillDirectory":87,"forksCount":88,"repositoryHtmlUrl":89,"repositoryHomepageUrl":90,"ownerHtmlUrl":91,"ownerBlogUrl":92,"ownerDescription":93,"updatedAt":94,"install":95,"resources":108},"01M6AG6EC1AA9ERA1PWEP324AP","recovering-from-ransomware-attack",null,"Executes structured ransomware incident recovery following NIST\u002FCISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory\u002Fdatabase recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"recovering from ransomware attack","ransomware","CISA","recovery","backup","t1059","Tools","t1078","t1003","defense","NIST","directory","cryptocurrency","encryption","incident-response","database","infrastructure","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: recovering-from-ransomware-attack\ndescription: 'Executes structured ransomware incident recovery following NIST\u002FCISA\n  frameworks: environment isolation, forensic evidence preservation, clean infrastructure\n  rebuild, prioritized restoration from verified backups, credential reset, and\n  Active Directory\u002Fdatabase recovery in dependency order. Use when recovering from\n  a ransomware attack, performing post-encryption restoration, or executing disaster\n  recovery after ransomware encryption.\n\n  '\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- recovery\n- incident-response\n- backup\n- defense\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1003\n- T1110\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - monetization\n  - defense-impairment\n  techniques:\n  - id: T1531\n    name: Account Access Removal\n    tactic: positioning\n    source: attack\n  - id: F1005\n    name: Account Manipulation\n    tactic: defense-impairment\n    source: f3\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n---\n# Recovering from Ransomware Attack\n\n## When to Use\n\n- After ransomware has encrypted production systems and the decision has been made to recover from backups\n- When building or validating a ransomware recovery runbook before an actual incident\n- After receiving a decryption key (paid ransom or law enforcement provided) and needing to safely decrypt\n- When partial recovery is needed alongside decryption of remaining systems\n- Conducting a recovery drill to validate RTO commitments\n\n**Do not use** before completing containment and forensic scoping. Premature recovery without understanding the attacker's access and persistence mechanisms risks re-infection.\n\n## Prerequisites\n\n- Incident declared and containment phase completed (all attacker access severed)\n- Forensic evidence preserved (disk images, memory dumps, network captures)\n- Backup integrity verified (immutable\u002Fair-gapped copies confirmed clean)\n- Clean build media available (OS installation media, golden images)\n- Recovery environment prepared (clean network segment isolated from compromised infrastructure)\n- Recovery priority list documented (Tier 1\u002F2\u002F3 systems in dependency order)\n\n## Workflow\n\n### Step 1: Establish Clean Recovery Environment\n\nBuild recovery infrastructure isolated from the compromised network:\n\n```bash\n# Create isolated recovery VLAN\n# No connectivity to compromised network segments\n# Dedicated internet access for patch downloads only (via proxy)\n\n# Recovery network architecture:\n# VLAN 999 (Recovery) - 10.99.0.0\u002F24\n#   - Recovery workstations (10.99.0.10-20)\n#   - Recovered DCs (10.99.0.50-55)\n#   - Recovered servers (10.99.0.100+)\n#   - Proxy for internet (10.99.0.1) - patches and updates only\n\n# Firewall rules: DENY all from recovery VLAN to production VLANs\n# Allow: Recovery VLAN -> Internet (HTTPS only, via proxy)\n# Allow: Recovery VLAN -> Backup infrastructure (restore traffic only)\n```\n\n### Step 2: Recover Identity Infrastructure First\n\nActive Directory must be recovered before any domain-joined systems:\n\n```powershell\n# AD Recovery Procedure\n# Step 2a: Restore AD from known-good backup\n# Use DSRM (Directory Services Restore Mode) boot\n\n# 1. Build clean Windows Server from ISO\n# 2. Promote as DC using AD restore\n# 3. Restore System State from immutable backup\n\n# Verify AD backup is pre-compromise\n# Check backup timestamp against earliest known compromise date\nwbadmin get versions -backuptarget:E: -machine:DC01\n\n# Restore system state in DSRM\nwbadmin start systemstaterecovery -version:02\u002F15\u002F2026-04:00 -backuptarget:E: -machine:DC01 -quiet\n\n# After restore, reset critical accounts\n# Reset krbtgt password TWICE (invalidates all Kerberos tickets)\n# This prevents Golden Ticket persistence\nImport-Module ActiveDirectory\nSet-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString \"NewKrbtgt2026!Complex#1\" -AsPlainText -Force)\n# Wait for replication (minimum 12 hours), then reset again\nSet-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString \"NewKrbtgt2026!Complex#2\" -AsPlainText -Force)\n\n# Reset all privileged account passwords\n$privilegedGroups = @(\"Domain Admins\", \"Enterprise Admins\", \"Schema Admins\", \"Administrators\")\nforeach ($group in $privilegedGroups) {\n    Get-ADGroupMember -Identity $group -Recursive | ForEach-Object {\n        Set-ADAccountPassword -Identity $_.SamAccountName -Reset `\n            -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force)\n        Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true\n    }\n}\n\n# Validate AD health\ndcdiag \u002Fv \u002Fc \u002Fd \u002Fe \u002Fs:DC01\nrepadmin \u002Fshowrepl\n```\n\n### Step 3: Validate Backup Integrity Before Restoration\n\n```bash\n# Scan backup files for ransomware artifacts before restoring\n# Use offline antivirus scanning on backup mount\n\n# Mount backup as read-only\nmount -o ro,noexec \u002Fdev\u002Fbackup_lv \u002Fmnt\u002Fbackup_verify\n\n# Scan with ClamAV\nclamscan -r --infected --log=\u002Fvar\u002Flog\u002Fbackup_scan.log \u002Fmnt\u002Fbackup_verify\n\n# Check for known ransomware indicators\nfind \u002Fmnt\u002Fbackup_verify -name \"*.encrypted\" -o -name \"*.locked\" \\\n    -o -name \"*.lockbit\" -o -name \"DECRYPT_*\" -o -name \"readme.txt\" \\\n    -o -name \"RECOVER-*\" -o -name \"HOW_TO_*\" | tee \u002Fvar\u002Flog\u002Fransomware_check.log\n\n# Verify database consistency (SQL Server example)\n# Restore database to temporary instance for validation\nRESTORE VERIFYONLY FROM DISK = '\u002Fmnt\u002Fbackup_verify\u002Fdatabases\u002Ferp_db.bak'\n    WITH CHECKSUM\n```\n\n### Step 4: Restore Systems in Priority Order\n\nFollow dependency-based recovery sequence:\n\n```\nRecovery Order:\nPhase 1 (Hours 0-4): Identity & Infrastructure\n  1. Domain Controllers (AD, DNS, DHCP)\n  2. Certificate Authority (if applicable)\n  3. Core network services (DHCP, NTP)\n\nPhase 2 (Hours 4-12): Critical Business Systems\n  4. Database servers (SQL, Oracle, PostgreSQL)\n  5. Core business applications (ERP, CRM)\n  6. Email (Exchange, M365 hybrid)\n\nPhase 3 (Hours 12-24): Important Systems\n  7. File servers\n  8. Web applications\n  9. Monitoring and security tools (SIEM, EDR)\n\nPhase 4 (Hours 24-48): Remaining Systems\n  10. Development environments\n  11. Archive systems\n  12. Non-critical applications\n```\n\n```powershell\n# Veeam Instant Recovery - fastest restore for VMware\u002FHyper-V\n# Boots VM directly from backup file, then migrates to production storage\n\n# Instant recovery for Tier 1 system\nStart-VBRInstantRecovery -RestorePoint (Get-VBRRestorePoint -Name \"DC01\" |\n    Sort-Object CreationTime -Descending | Select-Object -First 1) `\n    -VMName \"DC01-Recovered\" `\n    -Server (Get-VBRServer -Name \"esxi01.recovery.local\") `\n    -Datastore \"recovery-datastore\"\n\n# After validation, migrate to production storage\nStart-VBRQuickMigration -VM \"DC01-Recovered\" `\n    -Server (Get-VBRServer -Name \"esxi01.prod.local\") `\n    -Datastore \"production-datastore\"\n```\n\n### Step 5: Validate Recovered Systems and Harden\n\nBefore connecting recovered systems to production:\n\n```powershell\n# Check for persistence mechanisms\n# Scheduled Tasks\nGet-ScheduledTask | Where-Object {$_.State -ne \"Disabled\"} |\n    Select-Object TaskName, TaskPath, State, Author |\n    Export-Csv C:\\recovery\\scheduled_tasks.csv\n\n# Services\nGet-Service | Where-Object {$_.StartType -eq \"Automatic\"} |\n    Select-Object Name, DisplayName, StartType, Status |\n    Export-Csv C:\\recovery\\auto_services.csv\n\n# Startup items\nGet-CimInstance Win32_StartupCommand |\n    Select-Object Name, Command, Location, User |\n    Export-Csv C:\\recovery\\startup_items.csv\n\n# WMI event subscriptions (common persistence)\nGet-WmiObject -Namespace root\\subscription -Class __EventFilter\nGet-WmiObject -Namespace root\\subscription -Class __EventConsumer\n\n# Registry run keys\nGet-ItemProperty \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\nGet-ItemProperty \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nGet-ItemProperty \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n\n# Verify no unauthorized admin accounts\nGet-LocalGroupMember -Group \"Administrators\"\nGet-ADGroupMember -Identity \"Domain Admins\"\n\n# Apply latest patches before connecting to production\nInstall-WindowsUpdate -AcceptAll -AutoReboot\n```\n\n### Step 6: Phased Network Reconnection\n\n```\nPhase 1: Reconnect identity infrastructure\n  - DCs online in production VLAN\n  - Validate replication and authentication\n  - Monitor for suspicious authentication patterns\n\nPhase 2: Reconnect Tier 1 systems\n  - One system at a time\n  - Monitor EDR for 1 hour before proceeding to next\n  - Validate application functionality\n\nPhase 3: Reconnect remaining systems\n  - Groups of 5-10 systems\n  - Continue monitoring for re-infection indicators\n\nThroughout: SOC monitoring on high alert\n  - EDR in aggressive blocking mode\n  - All previous IOCs loaded in detection rules\n  - Canary files deployed on recovered systems\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **DSRM** | Directory Services Restore Mode: special boot mode for domain controllers that allows AD database restoration |\n| **krbtgt Reset** | Resetting the krbtgt account password twice invalidates all Kerberos tickets, defeating Golden Ticket persistence |\n| **Instant Recovery** | Backup technology that boots a VM directly from backup storage for immediate availability while migrating data in background |\n| **Evidence Preservation** | Maintaining forensic images and logs before recovery begins, required for law enforcement and insurance claims |\n| **Clean Build** | Rebuilding systems from trusted installation media rather than attempting to clean infected systems |\n| **Dependency Chain** | The order in which systems must be recovered based on service dependencies (e.g., AD before domain members) |\n\n## Tools & Systems\n\n- **Veeam Instant Recovery**: Boots VMs directly from backup with near-zero RTO, then live-migrates to production\n- **Microsoft DSRM**: AD-specific recovery mode for restoring domain controllers from backup\n- **DSInternals PowerShell Module**: Validates AD database integrity and identifies compromised credentials post-recovery\n- **Rubrik Instant Recovery**: Mounts backup as live VM in seconds for rapid recovery validation\n- **ClamAV**: Open-source antivirus for scanning backup files before restoration\n\n## Common Scenarios\n\n### Scenario: Manufacturing Company Full Recovery After LockBit Attack\n\n**Context**: A manufacturer with 300 servers has 80% of infrastructure encrypted by LockBit. Immutable backups from 48 hours ago are verified clean. Production lines are down, costing $500K\u002Fday.\n\n**Approach**:\n1. Establish recovery VLAN (10.99.0.0\u002F24) isolated from compromised network\n2. Restore 2 domain controllers from immutable backup using Veeam Instant Recovery (2 hours)\n3. Reset krbtgt password twice with 12-hour gap, reset all admin passwords\n4. Validate AD with dcdiag, scan for Golden Ticket indicators with DSInternals\n5. Restore ERP database (SAP) and verify data consistency (4 hours)\n6. Restore MES (Manufacturing Execution System) and SCADA historians (3 hours)\n7. Bring production line controllers online in isolated OT network first\n8. Phased reconnection over 48 hours with continuous EDR monitoring\n9. Total recovery: 72 hours (within 96-hour RTO commitment)\n\n**Pitfalls**:\n- Rushing to reconnect systems without validating absence of persistence mechanisms, causing re-infection\n- Restoring from the most recent backup without verifying it predates the compromise (attacker may have poisoned recent backups)\n- Not resetting the krbtgt password twice, allowing attackers to maintain Golden Ticket access\n- Restoring systems in the wrong order (application servers before their database dependencies)\n\n## Output Format\n\n```\n## Ransomware Recovery Status Report\n\n**Incident ID**: [ID]\n**Recovery Start**: [Timestamp]\n**Current Phase**: [1-4]\n**Estimated Completion**: [Timestamp]\n\n### Recovery Progress\n| Phase | Systems | Status | Started | Completed | RTO Target |\n|-------|---------|--------|---------|-----------|------------|\n| 1 - Identity | DC01, DC02, DNS | Complete | HH:MM | HH:MM | 4 hours |\n| 2 - Critical | ERP, DB01, DB02 | In Progress | HH:MM | -- | 12 hours |\n| 3 - Important | FS01, Email, Web | Pending | -- | -- | 24 hours |\n| 4 - Remaining | Dev, Archive | Pending | -- | -- | 48 hours |\n\n### Validation Checklist\n- [ ] AD integrity verified (dcdiag, repadmin)\n- [ ] krbtgt password reset (2x with interval)\n- [ ] All admin passwords reset\n- [ ] Persistence mechanisms scanned\n- [ ] EDR deployed and active on recovered systems\n- [ ] IOCs loaded in detection rules\n- [ ] Canary files deployed\n```\n","# Recovering from Ransomware Attack\n\n## When to Use\n\n- After ransomware has encrypted production systems and the decision has been made to recover from backups\n- When building or validating a ransomware recovery runbook before an actual incident\n- After receiving a decryption key (paid ransom or law enforcement provided) and needing to safely decrypt\n- When partial recovery is needed alongside decryption of remaining systems\n- Conducting a recovery drill to validate RTO commitments\n\n**Do not use** before completing containment and forensic scoping. Premature recovery without understanding the attacker's access and persistence mechanisms risks re-infection.\n\n## Prerequisites\n\n- Incident declared and containment phase completed (all attacker access severed)\n- Forensic evidence preserved (disk images, memory dumps, network captures)\n- Backup integrity verified (immutable\u002Fair-gapped copies confirmed clean)\n- Clean build media available (OS installation media, golden images)\n- Recovery environment prepared (clean network segment isolated from compromised infrastructure)\n- Recovery priority list documented (Tier 1\u002F2\u002F3 systems in dependency order)\n\n## Workflow\n\n### Step 1: Establish Clean Recovery Environment\n\nBuild recovery infrastructure isolated from the compromised network:\n\n```bash\n# Create isolated recovery VLAN\n# No connectivity to compromised network segments\n# Dedicated internet access for patch downloads only (via proxy)\n\n# Recovery network architecture:\n# VLAN 999 (Recovery) - 10.99.0.0\u002F24\n#   - Recovery workstations (10.99.0.10-20)\n#   - Recovered DCs (10.99.0.50-55)\n#   - Recovered servers (10.99.0.100+)\n#   - Proxy for internet (10.99.0.1) - patches and updates only\n\n# Firewall rules: DENY all from recovery VLAN to production VLANs\n# Allow: Recovery VLAN -> Internet (HTTPS only, via proxy)\n# Allow: Recovery VLAN -> Backup infrastructure (restore traffic only)\n```\n\n### Step 2: Recover Identity Infrastructure First\n\nActive Directory must be recovered before any domain-joined systems:\n\n```powershell\n# AD Recovery Procedure\n# Step 2a: Restore AD from known-good backup\n# Use DSRM (Directory Services Restore Mode) boot\n\n# 1. Build clean Windows Server from ISO\n# 2. Promote as DC using AD restore\n# 3. Restore System State from immutable backup\n\n# Verify AD backup is pre-compromise\n# Check backup timestamp against earliest known compromise date\nwbadmin get versions -backuptarget:E: -machine:DC01\n\n# Restore system state in DSRM\nwbadmin start systemstaterecovery -version:02\u002F15\u002F2026-04:00 -backuptarget:E: -machine:DC01 -quiet\n\n# After restore, reset critical accounts\n# Reset krbtgt password TWICE (invalidates all Kerberos tickets)\n# This prevents Golden Ticket persistence\nImport-Module ActiveDirectory\nSet-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString \"NewKrbtgt2026!Complex#1\" -AsPlainText -Force)\n# Wait for replication (minimum 12 hours), then reset again\nSet-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString \"NewKrbtgt2026!Complex#2\" -AsPlainText -Force)\n\n# Reset all privileged account passwords\n$privilegedGroups = @(\"Domain Admins\", \"Enterprise Admins\", \"Schema Admins\", \"Administrators\")\nforeach ($group in $privilegedGroups) {\n    Get-ADGroupMember -Identity $group -Recursive | ForEach-Object {\n        Set-ADAccountPassword -Identity $_.SamAccountName -Reset `\n            -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force)\n        Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true\n    }\n}\n\n# Validate AD health\ndcdiag \u002Fv \u002Fc \u002Fd \u002Fe \u002Fs:DC01\nrepadmin \u002Fshowrepl\n```\n\n### Step 3: Validate Backup Integrity Before Restoration\n\n```bash\n# Scan backup files for ransomware artifacts before restoring\n# Use offline antivirus scanning on backup mount\n\n# Mount backup as read-only\nmount -o ro,noexec \u002Fdev\u002Fbackup_lv \u002Fmnt\u002Fbackup_verify\n\n# Scan with ClamAV\nclamscan -r --infected --log=\u002Fvar\u002Flog\u002Fbackup_scan.log \u002Fmnt\u002Fbackup_verify\n\n# Check for known ransomware indicators\nfind \u002Fmnt\u002Fbackup_verify -name \"*.encrypted\" -o -name \"*.locked\" \\\n    -o -name \"*.lockbit\" -o -name \"DECRYPT_*\" -o -name \"readme.txt\" \\\n    -o -name \"RECOVER-*\" -o -name \"HOW_TO_*\" | tee \u002Fvar\u002Flog\u002Fransomware_check.log\n\n# Verify database consistency (SQL Server example)\n# Restore database to temporary instance for validation\nRESTORE VERIFYONLY FROM DISK = '\u002Fmnt\u002Fbackup_verify\u002Fdatabases\u002Ferp_db.bak'\n    WITH CHECKSUM\n```\n\n### Step 4: Restore Systems in Priority Order\n\nFollow dependency-based recovery sequence:\n\n```\nRecovery Order:\nPhase 1 (Hours 0-4): Identity & Infrastructure\n  1. Domain Controllers (AD, DNS, DHCP)\n  2. Certificate Authority (if applicable)\n  3. Core network services (DHCP, NTP)\n\nPhase 2 (Hours 4-12): Critical Business Systems\n  4. Database servers (SQL, Oracle, PostgreSQL)\n  5. Core business applications (ERP, CRM)\n  6. Email (Exchange, M365 hybrid)\n\nPhase 3 (Hours 12-24): Important Systems\n  7. File servers\n  8. Web applications\n  9. Monitoring and security tools (SIEM, EDR)\n\nPhase 4 (Hours 24-48): Remaining Systems\n  10. Development environments\n  11. Archive systems\n  12. Non-critical applications\n```\n\n```powershell\n# Veeam Instant Recovery - fastest restore for VMware\u002FHyper-V\n# Boots VM directly from backup file, then migrates to production storage\n\n# Instant recovery for Tier 1 system\nStart-VBRInstantRecovery -RestorePoint (Get-VBRRestorePoint -Name \"DC01\" |\n    Sort-Object CreationTime -Descending | Select-Object -First 1) `\n    -VMName \"DC01-Recovered\" `\n    -Server (Get-VBRServer -Name \"esxi01.recovery.local\") `\n    -Datastore \"recovery-datastore\"\n\n# After validation, migrate to production storage\nStart-VBRQuickMigration -VM \"DC01-Recovered\" `\n    -Server (Get-VBRServer -Name \"esxi01.prod.local\") `\n    -Datastore \"production-datastore\"\n```\n\n### Step 5: Validate Recovered Systems and Harden\n\nBefore connecting recovered systems to production:\n\n```powershell\n# Check for persistence mechanisms\n# Scheduled Tasks\nGet-ScheduledTask | Where-Object {$_.State -ne \"Disabled\"} |\n    Select-Object TaskName, TaskPath, State, Author |\n    Export-Csv C:\\recovery\\scheduled_tasks.csv\n\n# Services\nGet-Service | Where-Object {$_.StartType -eq \"Automatic\"} |\n    Select-Object Name, DisplayName, StartType, Status |\n    Export-Csv C:\\recovery\\auto_services.csv\n\n# Startup items\nGet-CimInstance Win32_StartupCommand |\n    Select-Object Name, Command, Location, User |\n    Export-Csv C:\\recovery\\startup_items.csv\n\n# WMI event subscriptions (common persistence)\nGet-WmiObject -Namespace root\\subscription -Class __EventFilter\nGet-WmiObject -Namespace root\\subscription -Class __EventConsumer\n\n# Registry run keys\nGet-ItemProperty \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\nGet-ItemProperty \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nGet-ItemProperty \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n\n# Verify no unauthorized admin accounts\nGet-LocalGroupMember -Group \"Administrators\"\nGet-ADGroupMember -Identity \"Domain Admins\"\n\n# Apply latest patches before connecting to production\nInstall-WindowsUpdate -AcceptAll -AutoReboot\n```\n\n### Step 6: Phased Network Reconnection\n\n```\nPhase 1: Reconnect identity infrastructure\n  - DCs online in production VLAN\n  - Validate replication and authentication\n  - Monitor for suspicious authentication patterns\n\nPhase 2: Reconnect Tier 1 systems\n  - One system at a time\n  - Monitor EDR for 1 hour before proceeding to next\n  - Validate application functionality\n\nPhase 3: Reconnect remaining systems\n  - Groups of 5-10 systems\n  - Continue monitoring for re-infection indicators\n\nThroughout: SOC monitoring on high alert\n  - EDR in aggressive blocking mode\n  - All previous IOCs loaded in detection rules\n  - Canary files deployed on recovered systems\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **DSRM** | Directory Services Restore Mode: special boot mode for domain controllers that allows AD database restoration |\n| **krbtgt Reset** | Resetting the krbtgt account password twice invalidates all Kerberos tickets, defeating Golden Ticket persistence |\n| **Instant Recovery** | Backup technology that boots a VM directly from backup storage for immediate availability while migrating data in background |\n| **Evidence Preservation** | Maintaining forensic images and logs before recovery begins, required for law enforcement and insurance claims |\n| **Clean Build** | Rebuilding systems from trusted installation media rather than attempting to clean infected systems |\n| **Dependency Chain** | The order in which systems must be recovered based on service dependencies (e.g., AD before domain members) |\n\n## Tools & Systems\n\n- **Veeam Instant Recovery**: Boots VMs directly from backup with near-zero RTO, then live-migrates to production\n- **Microsoft DSRM**: AD-specific recovery mode for restoring domain controllers from backup\n- **DSInternals PowerShell Module**: Validates AD database integrity and identifies compromised credentials post-recovery\n- **Rubrik Instant Recovery**: Mounts backup as live VM in seconds for rapid recovery validation\n- **ClamAV**: Open-source antivirus for scanning backup files before restoration\n\n## Common Scenarios\n\n### Scenario: Manufacturing Company Full Recovery After LockBit Attack\n\n**Context**: A manufacturer with 300 servers has 80% of infrastructure encrypted by LockBit. Immutable backups from 48 hours ago are verified clean. Production lines are down, costing $500K\u002Fday.\n\n**Approach**:\n1. Establish recovery VLAN (10.99.0.0\u002F24) isolated from compromised network\n2. Restore 2 domain controllers from immutable backup using Veeam Instant Recovery (2 hours)\n3. Reset krbtgt password twice with 12-hour gap, reset all admin passwords\n4. Validate AD with dcdiag, scan for Golden Ticket indicators with DSInternals\n5. Restore ERP database (SAP) and verify data consistency (4 hours)\n6. Restore MES (Manufacturing Execution System) and SCADA historians (3 hours)\n7. Bring production line controllers online in isolated OT network first\n8. Phased reconnection over 48 hours with continuous EDR monitoring\n9. Total recovery: 72 hours (within 96-hour RTO commitment)\n\n**Pitfalls**:\n- Rushing to reconnect systems without validating absence of persistence mechanisms, causing re-infection\n- Restoring from the most recent backup without verifying it predates the compromise (attacker may have poisoned recent backups)\n- Not resetting the krbtgt password twice, allowing attackers to maintain Golden Ticket access\n- Restoring systems in the wrong order (application servers before their database dependencies)\n\n## Output Format\n\n```\n## Ransomware Recovery Status Report\n\n**Incident ID**: [ID]\n**Recovery Start**: [Timestamp]\n**Current Phase**: [1-4]\n**Estimated Completion**: [Timestamp]\n\n### Recovery Progress\n| Phase | Systems | Status | Started | Completed | RTO Target |\n|-------|---------|--------|---------|-----------|------------|\n| 1 - Identity | DC01, DC02, DNS | Complete | HH:MM | HH:MM | 4 hours |\n| 2 - Critical | ERP, DB01, DB02 | In Progress | HH:MM | -- | 12 hours |\n| 3 - Important | FS01, Email, Web | Pending | -- | -- | 24 hours |\n| 4 - Remaining | Dev, Archive | Pending | -- | -- | 48 hours |\n\n### Validation Checklist\n- [ ] AD integrity verified (dcdiag, repadmin)\n- [ ] krbtgt password reset (2x with interval)\n- [ ] All admin passwords reset\n- [ ] Persistence mechanisms scanned\n- [ ] EDR deployed and active on recovered systems\n- [ ] IOCs loaded in detection rules\n- [ ] Canary files deployed\n```\n",{"name":5,"tags":48,"author":49,"domain":42,"license":15,"version":50,"mitre_f3":51,"nist_csf":72,"subdomain":77,"description":78,"mitre_attack":79},[25,27,38,28,33],"mahipal","1.0.0",{"tactics":52,"version":56,"techniques":57},[53,54,55],"positioning","monetization","defense-impairment","1.1",[58,62,66,69],{"id":59,"name":60,"source":61,"tactic":53},"T1531","Account Access Removal","attack",{"id":63,"name":64,"source":65,"tactic":55},"F1005","Account Manipulation","f3",{"id":67,"name":68,"source":65,"tactic":54},"F1018","Convert to Cryptocurrency",{"id":70,"name":71,"source":61,"tactic":53},"T1219","Remote Access Tools",[73,74,75,76],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense","Executes structured ransomware incident recovery following NIST\u002FCISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory\u002Fdatabase recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.\n",[80,81,82,83,84],"T1078","T1190","T1059","T1003","T1110","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Frecovering-from-ransomware-attack",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":96,"prompt":106,"zipAvailable":107},[97,100,103],{"tool":98,"command":99},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill recovering-from-ransomware-attack",{"tool":101,"command":102},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill recovering-from-ransomware-attack",{"tool":104,"command":105},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill recovering-from-ransomware-attack","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002FSKILL.md",true,[109,114,118,124,128,132,138],{"path":110,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002FLICENSE",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"LICENSE.txt",143,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-competitor-pages\u002FLICENSE.txt",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fapi-reference.md","REFERENCE","参考文档",1726,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002Freferences\u002Fapi-reference.md",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"references\u002Fstandards.md",1069,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002Freferences\u002Fstandards.md",{"path":129,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":130,"sourceHtmlUrl":131},"references\u002Fworkflows.md",1403,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002Freferences\u002Fworkflows.md",{"path":133,"resourceType":134,"resourceTypeDesc":135,"sizeBytes":136,"sourceHtmlUrl":137},"scripts\u002Fagent.py","SCRIPT","脚本",6735,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002Fscripts\u002Fagent.py",{"path":139,"resourceType":134,"resourceTypeDesc":135,"sizeBytes":140,"sourceHtmlUrl":141},"scripts\u002Fprocess.py",11115,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frecovering-from-ransomware-attack\u002Fscripts\u002Fprocess.py",[143,169,192,213,239,265],{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[149],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,152,153,154,155,42,156,157,41,158,159,160,161,162,163,164,165,166,167,168],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[175],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[177,165,178,179,155,180,42,41,181,182,183,30,184,185,186,187,188,189,190,191],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":202,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[198,201],{"categoryNo":199,"categoryName":200,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[186,28,27,203,204,42,40,205,181,206,207,38,25,36,208,31,209,210,211,212],"validating backup integrity for recovery","testing","validation","compliance","hash-verification","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,42,224,225,226,227,228,229,230,231,232,233,234,235,30,236,237,238],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[245],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[247,248,249,42,250,251,26,252,253,254,255,256,257,258,259,260,261,262,263,264],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":266,"name":267,"nameZh":6,"description":268,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":269,"categories":270,"keywords":272,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[271],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,273,42,274,275,276,277,278,34,279,280,31,281,209,282,283,284,285,286,287],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]