Skill UI

Analyzes ransomware encryption algorithms, key management, and file routines to assess decryption feasibility, highlight weaknesses, and guide forensic recovery or decryptor development for known ransomware families.

Designs structured incident response playbooks aligned with NIST SP 800-61r3 and SANS PICERL, documenting RACI matrices, decision trees, escalation criteria, containment/recovery procedures, and SOAR automations for consistent handling of ransomware, phishing, and other incidents.

Workflows for collecting memory dumps, ransom notes, encrypted samples, and log data to identify ransomware variants, attack timelines, and recovery options after an incident.

Generates a CISA StopRansomware and NIST CSF-aligned ransomware response playbook with actionable checklists for preparation, detection, containment, eradication, recovery, and post-incident refinement when planning or assessing readiness.

Validates ransomware recovery plans by simulating restores, measuring RTO/RPO, and confirming data integrity so teams know backup workflows meet resilience goals.

Validates backup integrity via hash manifests, restore tests, and anomaly detection, ensuring recovery readiness for ransomware or disaster response pipelines. Use it in CI/CD backup validation schedules, restore drills, and compliance audits.