building-soc-playbook-for-ransomware

构建针对勒索软件的 SOC 手册

何时使用

在以下情况下使用本技能：

• SOC 团队需要为 Tier 1-3 分析师提供标准化的勒索软件响应手册
• 组织缺乏针对勒索软件遏制与恢复的文档化流程
• 桌面演练暴露了勒索软件响应协调中的缺口
• 合规要求（NIST CSF、ISO 27001）强制要求具备文档化的事件手册

请勿在勒索软件事件活跃期间将其作为唯一指南使用——应在事件发生前准备好经过测试和演练的预构建手册。

前提条件

• 具备端点与网络数据的 SIEM 平台（Splunk ES、Elastic Security 或 Sentinel）
• 具备网络隔离能力的 EDR 解决方案（CrowdStrike、SentinelOne 或 Microsoft Defender for Endpoint）
• 具备经过测试的恢复流程以及离线/不可变备份的备份基础设施
• 与法务、高管层以及外部 IR 应急响应服务商联系人之间的沟通计划
• 针对勒索软件技术链的 MITRE ATT&CK 知识

工作流

步骤 1：定义检测触发器

为早期勒索软件指标创建 SIEM 检测规则：

大规模文件加密检测（Splunk）：

index=sysmon EventCode=11
| bin _time span=1m
| stats dc(TargetFilename) AS unique_files, values(TargetFilename) AS sample_files by Computer, Image, _time
| where unique_files > 100
| eval suspicious_extensions = if(match(mvjoin(sample_files, ","), "\.(encrypted|locked|crypt|enc|ransom)"), "YES", "NO")
| where suspicious_extensions="YES" OR unique_files > 500
| sort - unique_files

卷影副本删除（T1490）：

index=wineventlog sourcetype="WinEventLog:Security" OR index=sysmon EventCode=1
(CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*"
 OR CommandLine="*bcdedit*/set*recoveryenabled*no*" OR CommandLine="*wbadmin*delete*catalog*")
| table _time, Computer, User, ParentImage, Image, CommandLine

勒索软件说明文件创建：

index=sysmon EventCode=11
TargetFilename IN ("*README*.txt", "*DECRYPT*.txt", "*RANSOM*.txt", "*RECOVER*.html", "*HOW_TO*.txt")
| stats count by Computer, Image, TargetFilename
| where count > 5

Elastic Security EQL 变体：

sequence by host.name with maxspan=2m
  [process where event.type == "start" and
    process.args : ("*vssadmin*", "*delete*", "*shadows*")]
  [file where event.type == "creation" and
    file.name : ("*README*DECRYPT*", "*RANSOM*", "*HOW_TO_RECOVER*")]

步骤 2：构建分诊决策树

RANSOMWARE ALERT TRIAGE
│
├── Is encryption actively occurring?
│   ├── YES → IMMEDIATE: Isolate host from network (Step 3)
│   │         Do NOT power off (preserve memory for forensics)
│   └── NO → Is this a pre-encryption indicator?
│       ├── Shadow copy deletion → HIGH PRIORITY: Isolate and investigate
│       ├── Known ransomware hash → HIGH PRIORITY: Block hash, scan enterprise
│       └── Suspicious process behavior → MEDIUM: Investigate, prepare isolation
│
├── How many hosts affected?
│   ├── Single host → Contained incident, follow host isolation procedure
│   ├── Multiple hosts (2-10) → Escalate to Tier 2, begin enterprise-wide scan
│   └── Enterprise-wide (>10) → Activate full IR team, engage external retainer
│
└── Is data exfiltration confirmed?
    ├── YES → Double extortion scenario, engage legal for breach notification
    └── NO/UNKNOWN → Check for Cobalt Strike/C2 beacons, review outbound transfers

步骤 3：遏制流程

通过 EDR 进行网络隔离（CrowdStrike Falcon）：

# Isolate host using CrowdStrike Falcon API
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["device_id_here"]}'

通过 Microsoft Defender for Endpoint 进行网络隔离：

# Isolate machine via MDE API
$headers = @{Authorization = "Bearer $token"}
$body = @{Comment = "Ransomware containment - IR-2024-0500"; IsolationType = "Full"} | ConvertTo-Json
Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" `
    -Method Post -Headers $headers -Body $body -ContentType "application/json"

防火墙应急规则：

# Palo Alto — Block SMB lateral spread
set rulebase security rules RansomwareContainment from Trust to Trust
set rulebase security rules RansomwareContainment application ms-ds-smb
set rulebase security rules RansomwareContainment action deny
set rulebase security rules RansomwareContainment disabled no
commit

Active Directory 应急操作：

# Disable compromised account
Disable-ADAccount -Identity "compromised_user"

# Reset Kerberos TGT (if domain admin compromised)
# WARNING: This resets krbtgt and requires two resets 12+ hours apart
Reset-KrbtgtKeys -Server "DC-PRIMARY" -Force

# Block lateral movement by disabling remote services
Set-Service -Name "RemoteRegistry" -StartupType Disabled -Status Stopped

步骤 4：证据收集与保全

在修复之前收集取证工件：

# Capture running processes and network connections
Get-Process | Export-Csv "C:\IR\processes_$(hostname).csv"
Get-NetTCPConnection | Export-Csv "C:\IR\netstat_$(hostname).csv"

# Capture memory dump (if host still running)
winpmem_mini_x64.exe C:\IR\memory_$(hostname).raw

# Collect ransomware artifacts
Copy-Item "C:\Users\*\Desktop\*README*" "C:\IR\ransom_notes\" -Recurse
Copy-Item "C:\Users\*\Desktop\*.encrypted" "C:\IR\encrypted_samples\" -Force

# Capture event logs
wevtutil epl Security "C:\IR\Security_$(hostname).evtx"
wevtutil epl System "C:\IR\System_$(hostname).evtx"
wevtutil epl "Microsoft-Windows-Sysmon/Operational" "C:\IR\Sysmon_$(hostname).evtx"

步骤 5：清除与恢复

识别勒索软件变种：

• 将加密样本和勒索说明上传至 ID Ransomware（https://id-ransomware.malwarehunterteam.com/）
• 在 No More Ransom Project（https://www.nomoreransom.org/）中查找可用的解密工具
• 在 MalwareBazaar 中搜索勒索软件家族的 IOC

在 Splunk 中进行企业范围的 IOC 扫描：

index=sysmon (EventCode=1 OR EventCode=11 OR EventCode=3)
(TargetFilename="*ransomware_binary_name*" OR sha256="KNOWN_HASH"
 OR DestinationIp="C2_IP_ADDRESS" OR CommandLine="*malicious_command*")
| stats count by Computer, EventCode, Image, CommandLine
| sort - count

从备份恢复：

1. 验证备份完整性（未受影响的离线/不可变备份）
2. 使用已知良好的镜像重建受影响系统
3. 从最后一次干净备份恢复数据
4. 在重新连接到网络之前验证已恢复的系统
5. 对已恢复系统进行 72 小时监控，以防再次感染

步骤 6：事件后文档记录

用经验教训构建手册结论：

POST-INCIDENT REVIEW TEMPLATE
1. Timeline of events (detection to full recovery)
2. Initial access vector identification
3. Dwell time analysis (time from initial compromise to encryption)
4. Detection gaps identified
5. Response effectiveness metrics (MTTD, MTTC, MTTR)
6. Playbook improvements recommended
7. New detection rules deployed
8. Backup and recovery procedure updates

关键概念

术语	定义
双重勒索	勒索软件策略，将数据加密与数据窃取相结合，若不支付赎金则威胁公开数据
驻留时间	从初始入侵到检测之间的持续时间——勒索软件运营者在加密前平均为 5-9 天
MTTC	平均遏制时间（Mean Time to Contain）——从检测到成功隔离受影响系统的时间
杀伤链	勒索软件演进过程：初始访问 -> 执行 -> 持久化 -> 权限提升 -> 横向移动 -> 收集 -> 外泄 -> 影响
不可变备份	在定义的保留期内无法修改或删除的备份存储（WORM 存储）
RTO/RPO	恢复时间目标 / 恢复点目标——最大可接受停机时间和数据丢失阈值

工具与系统

• CrowdStrike Falcon / SentinelOne：具备网络隔离、进程终止和威胁狩猎能力的 EDR 平台
• Splunk ES / Elastic Security：用于部署检测规则和执行企业范围 IOC 扫描的 SIEM 平台
• ID Ransomware：根据加密文件样本和勒索说明识别勒索软件变种的在线服务
• No More Ransom Project：由 Europol 支持的倡议，为已知勒索软件家族提供免费解密工具
• Veeam / Rubrik：支持不可变备份和即时恢复能力的企业备份解决方案

常见场景

• LockBit 攻击：通过 SMB 横向移动和大规模文件加密检测到 — 隔离，扫描 Cobalt Strike 信标
• BlackCat/ALPHV：通过勒索信创建检测到 — 检查是否通过 Rclone 或 Mega 上传进行数据外泄
• Conti/Royal：通过卷影副本删除检测到 — 检查此前是否存在 BazarLoader/Emotet 初始访问
• RansomHub：通过异常进程执行检测到 — 调查是否存在被入侵的 VPN 或 RDP 凭据
• Play 勒索软件：通过服务账户滥用检测到 — 审计 AD 中新建的账户和组成员身份变更

输出格式

RANSOMWARE PLAYBOOK EXECUTION — IR-2024-0500
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Phase 1 - Detection:
  Alert:      Mass file encryption detected on FILESERVER-03
  Variant:    LockBit 3.0 (confirmed via ID Ransomware)
  MTTD:       12 minutes from first encryption to SOC alert

Phase 2 - Containment:
  [DONE] FILESERVER-03 isolated via CrowdStrike at 14:35 UTC
  [DONE] SMB blocked enterprise-wide via firewall emergency rule
  [DONE] Compromised service account disabled in AD
  MTTC:       23 minutes

Phase 3 - Eradication:
  [DONE] 3 additional hosts with C2 beacon identified and isolated
  [DONE] Cobalt Strike C2 domain (c2[.]evil[.]com) sinkholed
  [DONE] Enterprise-wide IOC scan completed — no additional infections

Phase 4 - Recovery:
  [DONE] FILESERVER-03 rebuilt from gold image
  [DONE] Data restored from immutable Veeam backup (RPO: 4 hours)
  [DONE] Systems monitored 72 hours — no reinfection
  MTTR:       18 hours

Total Affected: 1 server, 3 workstations
Data Loss:      4 hours of file modifications (backup RPO)
Exfiltration:   No evidence of data exfiltration confirmed