building-ransomware-playbook-with-cisa-framework

使用 CISA 框架构建勒索软件响应手册

何时使用

• 组织需要按照 CISA 指南创建或更新其勒索软件事件响应手册
• 安全团队正在依据 CISA StopRansomware 框架进行勒索软件准备度评估
• 合规要求记录与 NIST CSF 和 CISA 建议一致的勒索软件响应流程
• 在桌面演练期间，验证组织的勒索软件响应步骤是否符合行业最佳实践
• 在勒索软件事件发生后，用经验教训更新手册并弥合已发现的差距

请勿使用本手册替代关于赎金支付决策、违规通知时间表或您所在司法管辖区特定监管义务的法律顾问。

前置条件

• 熟悉 CISA StopRansomware 指南（cisa.gov/stopransomware/ransomware-guide）
• 理解 NIST 网络安全框架（CSF）（识别、保护、检测、响应、恢复）
• 关键资产、备份基础设施和通信渠道的清单
• 事件响应团队成员的既定角色和职责
• Python 3.8+，用于手册生成和合规检查自动化
• 可访问组织的资产清单和备份配置文档

工作流

步骤 1：准备阶段（CISA 第 1 部分 - 预防）

在事件发生前建立针对勒索软件的防御：

CISA Preparation Checklist:
━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Maintain offline, encrypted backups tested for restoration
[ ] Create and exercise a cyber incident response plan (IRP)
[ ] Implement network segmentation between IT and OT networks
[ ] Enable MFA on all remote access and privileged accounts
[ ] Deploy endpoint detection and response (EDR) on all endpoints
[ ] Disable or restrict RDP; require VPN for remote access
[ ] Maintain a software/hardware asset inventory
[ ] Apply patches within 48 hours for internet-facing systems
[ ] Configure email filtering and disable macro execution by default
[ ] Conduct regular phishing awareness training
[ ] Implement application allowlisting (AppLocker/WDAC)
[ ] Test backup restoration quarterly and document RTO/RPO

步骤 2：检测与分析阶段

识别勒索软件指标并评估范围：

Detection Indicators:
━━━━━━━━━━━━━━━━━━━━
- Mass file rename operations with new extensions (.locked, .encrypted)
- Ransom notes appearing in directories (README.txt, DECRYPT.html)
- Volume Shadow Copy deletion (vssadmin delete shadows)
- Abnormal CPU usage from encryption processes
- EDR/AV alerts for known ransomware signatures
- Network connections to known C2 infrastructure
- Unusual lateral movement via SMB or PsExec
- Sysmon Event ID 11 (file creation) spikes

Initial Analysis Steps (CISA):
  1. Take system images and memory captures of affected devices
  2. Identify patient zero and initial access vector
  3. Determine the ransomware family (ID Ransomware, ransom note analysis)
  4. Assess encryption scope: which systems, shares, and data are affected
  5. Check if data exfiltration occurred (double extortion indicator)

步骤 3：遏制阶段

阻止传播并保留证据：

Immediate Containment (First 1-4 hours):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Isolate affected systems from the network (disable NICs, VLAN quarantine)
2. If unable to disconnect, power down affected systems
3. Disable shared drives to prevent encryption spread
4. Reset credentials for compromised accounts (especially admin/service accounts)
5. Block known ransomware IOCs at firewall/proxy (C2 domains, IPs)
6. Preserve forensic evidence (memory dumps, disk images, logs)
7. Engage legal counsel and prepare breach notification if data exfiltrated

Extended Containment:
  - Identify and patch the initial access vector (phishing, RDP, VPN vuln)
  - Audit all Active Directory accounts for persistence (scheduled tasks, services)
  - Check for backdoors or additional malware beyond the ransomware payload

步骤 4：根除与恢复阶段

移除威胁并恢复运营：

CISA Recovery Steps:
━━━━━━━━━━━━━━━━━━━
1. Rebuild affected systems from known-clean images (do NOT decrypt in place)
2. Restore data from offline backups (verify backup integrity first)
3. Reset ALL passwords including service accounts, krbtgt (twice, 12h apart)
4. Scan restored systems with updated AV/EDR before reconnecting to network
5. Re-enable services in priority order based on business criticality
6. Monitor restored systems intensively for 72 hours for reinfection

Recovery Priority Matrix:
  P1 (0-4h):  Domain controllers, DNS, authentication infrastructure
  P2 (4-24h): Email, critical business applications, databases
  P3 (1-3d):  File servers, departmental applications
  P4 (3-7d):  Non-critical systems, development environments

步骤 5：事件后活动

记录经验教训并改进防御：

Post-Incident Report Template:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Executive summary: What happened, impact, resolution
2. Timeline: Detection to full recovery with timestamps
3. Root cause analysis: Initial access vector and propagation path
4. Scope: Number of systems, data volumes, business impact in hours/dollars
5. Response effectiveness: What worked, what failed, what was missing
6. Recommendations: Specific technical and procedural improvements
7. Compliance actions: Notification timeline, regulatory obligations met
8. Updated playbook: Revisions based on lessons learned

验证

• 对照 CISA StopRansomware 检查清单项验证手册的完整性
• 与所有利益相关者一起使用手册进行桌面演练
• 验证备份恢复流程在记录的 RTO 目标内有效
• 测试通信计划，包括带外渠道
• 确认法律和监管通知程序是最新的
• 至少每年或在任何事件后审查并更新手册

关键概念

术语	定义
CISA StopRansomware 指南	CISA/MS-ISAC/NSA/FBI 联合指南，提供勒索软件预防最佳实践和响应检查清单
RTO/RPO	恢复时间目标（最大停机时间）和恢复点目标（最大数据丢失）；备份规划的关键指标
双重勒索	一种勒索软件策略，攻击者既加密数据又威胁发布窃取的数据，除非支付赎金
零号病人	事件中第一个被攻陷的系统；识别它可以揭示初始访问途径
桌面演练	响应团队在不使用实时系统的情况下，通过模拟事件场景来验证手册

工具与系统

• CISA StopRansomware 指南：勒索软件响应规划和预防的主要框架
• NIST CSF：提供识别/保护/检测/响应/恢复结构的网络安全框架
• ID Ransomware：用于从加密文件和勒索信识别勒索软件家族的服务
• MITRE ATT&CK：用于将勒索软件 TTP 映射到检测机会的技术框架
• Velociraptor：用于事件期间快速分诊和取证工件收集的端点可见性工具