seikaikyo/testing-ransomware-recovery-procedures
external/anthropic-cybersecurity-skills/skills/testing-ransomware-recovery-procedures/SKILL.md
Test and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.
$ install --global
skillsauthnpx skillsauth add seikaikyo/dash-skills testing-ransomware-recovery-proceduresInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 21, 2026, 4:10 AM160.8s3 files scanned
SKILL.md
- name:
- Conversion to Physical Monetary Instruments: Cash
- description:
- Test and validate ransomware recovery procedures including backup restore
- domain:
- cybersecurity
- subdomain:
- incident-response
- version:
- 1.1
- author:
- mahipal
- license:
- Apache-2.0
- - id:
- F1017.001
- tactic:
- monetization
- source:
- f3
Testing Ransomware Recovery Procedures
When to Use
Use this skill when:
- Validating that ransomware recovery plans actually work under realistic conditions
- Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements
- Testing backup restore operations to confirm data integrity and completeness after simulated encryption
- Conducting tabletop exercises or live recovery drills for ransomware scenarios
- Auditing disaster recovery readiness as part of compliance or cyber insurance requirements
Do not use for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.
Prerequisites
- Isolated recovery test environment (air-gapped or network-segmented lab)
- Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)
- Documented RTO/RPO targets per application tier from business impact analysis
- Backup copies available for restore testing (production replicas or test snapshots)
- Recovery runbooks with step-by-step procedures for each critical system
Workflow
Step 1: Define Recovery Test Scope
Identify critical systems and their tiered recovery targets:
| Tier | System Type | RTO Target | RPO Target | Example | |------|------------|------------|------------|---------| | Tier 1 | Mission-critical | < 1 hour | < 15 min | Active Directory, core database | | Tier 2 | Business-critical | < 4 hours | < 1 hour | ERP, email, CRM | | Tier 3 | Business-operational | < 24 hours | < 4 hours | File shares, internal apps | | Tier 4 | Non-critical | < 72 hours | < 24 hours | Dev/test, analytics |
Step 2: Prepare Test Environment
# Verify isolated recovery network is segmented
# No routes to production should exist
ip route show | grep -v "192.168.100.0/24" # recovery VLAN only
# Verify backup catalog is accessible
restic snapshots --repo s3:s3.amazonaws.com/backup-bucket --password-file /etc/restic/pw
# Or for Veeam:
# Get-VBRBackup | Where-Object {$_.JobType -eq "Backup"} | Select Name, LastPointCreationTime
Step 3: Execute Restore and Measure RTO
For each tiered system, measure the full recovery timeline:
- Detection to Decision - Time from simulated alert to restore decision
- Backup Locate - Time to identify and select the correct clean restore point
- Restore Execution - Time to restore data/VM/application from backup
- Validation - Time to verify data integrity and application functionality
- Service Restoration - Time until the system is fully operational
Recovery Timeline Measurement:
T0: Incident declared (simulated ransomware detection)
T1: Recovery team assembled and backup identified
T2: Restore initiated from clean backup
T3: Restore completed, integrity checks passed
T4: Application validated and service restored
Actual RTO = T4 - T0
Actual RPO = T0 - backup_timestamp
Step 4: Validate Data Integrity Post-Restore
# Compare file counts between backup manifest and restored data
find /restored/data -type f | wc -l
# Compare against pre-backup manifest
# Verify database consistency after restore
pg_isready -h localhost -p 5432
psql -c "SELECT count(*) FROM critical_table;" -d restored_db
# Hash verification of critical files
sha256sum /restored/data/critical_config.xml
# Compare against known-good hash from backup manifest
Step 5: Test Credential Rotation and Security Hardening
After restore, validate that security controls are re-established:
- Rotate all service account passwords and API keys
- Verify MFA is enabled on all administrative accounts
- Confirm EDR/AV agents are running and reporting to management console
- Validate firewall rules block known C2 indicators
- Check that restored systems have latest security patches
Step 6: Document Results and Calculate Gap
Recovery Test Report:
System: [Name]
Tier: [1-4]
RTO Target: [target] Actual RTO: [measured] Gap: [delta]
RPO Target: [target] Actual RPO: [measured] Gap: [delta]
Data Integrity: [PASS/FAIL]
Application Validation: [PASS/FAIL]
Security Controls Restored: [PASS/FAIL]
Status: [MEETS TARGET / EXCEEDS TARGET / FAILS TARGET]
Remediation Required: [description if FAILS]
Key Concepts
| Term | Definition | |------|-----------| | RTO | Recovery Time Objective: maximum acceptable downtime for a system after a disaster | | RPO | Recovery Point Objective: maximum acceptable data loss measured in time | | WRT | Work Recovery Time: time to verify system integrity after restore completes | | MTD | Maximum Tolerable Downtime: absolute limit before unacceptable business impact | | Clean Restore Point | A backup verified to be free of ransomware artifacts or encryption | | Recovery Sequencing | The order in which interdependent systems must be restored | | Air-Gapped Backup | Backup stored on media physically disconnected from the network |
Tools & Systems
| Tool | Purpose | |------|---------| | Veeam Backup & Replication | VM and physical server backup and restore | | Commvault | Enterprise data protection and recovery orchestration | | Rubrik | Cloud-native backup with ransomware recovery SLA | | AWS Backup | Centralized backup for AWS services | | Azure Backup | Microsoft cloud backup with immutable vault | | Restic | Open-source encrypted backup tool | | Velero | Kubernetes cluster backup and restore |
Common Pitfalls
- Not testing restores regularly: Backups that are never tested often fail when needed. Test quarterly at minimum.
- Ignoring recovery sequencing: Restoring an application before its database dependency causes cascading failures.
- Skipping credential rotation: Restored systems may contain compromised credentials that allow re-infection.
- Using production network for testing: Recovery tests on production networks risk spreading simulated or real infections.
- Measuring RTO without WRT: Restore completion is not recovery completion. Include validation and hardening time.
- No immutable backups: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.
References
- NIST SP 800-184: Guide for Cybersecurity Event Recovery
- CISA Ransomware Guide: https://www.cisa.gov/stopransomware
- Veeam RTO/RPO Best Practices: https://www.veeam.com/blog/recovery-time-recovery-point-objectives.html
- NIST CSF 2.0 RC.RP (Recovery Planning)
Related Skills
seikaikyo/conducting-gdpr-compliance-assessment
tools
VerifiedTrustedCommunity
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
2SKILL.mdUpdated Sep 11, 2026
seikaikyo/parsing-artifacts-with-eric-zimmerman-tools
tools
VerifiedTrustedCommunity
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
2SKILL.mdUpdated Jun 23, 2026
seikaikyo/orchestrating-llm-attacks-with-pyrit
development
VerifiedTrustedCommunity
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
2SKILL.mdUpdated Jun 23, 2026
seikaikyo/operationalizing-misp-threat-feeds
testing
VerifiedTrustedCommunity
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.
2SKILL.mdUpdated Jun 23, 2026