Skill UI

Generates a CISA StopRansomware and NIST CSF-aligned ransomware response playbook with actionable checklists for preparation, detection, containment, eradication, recovery, and post-incident refinement when planning or assessing readiness.

Deploys honeytoken decoy files across critical shares and endpoints, watches them with file-integrity or OS-level observers, and alerts SOCs when ransomware modifies, encrypts, or renames a canary, offering a precise detection layer that complements backups and EDR.

Guides administrators through configuring Windows Group Policy Objects to block ransomware execution paths, enable AppLocker, Controlled Folder Access, ASR rules, and restrict lateral movement, making GPOs part of a broader defense-in-depth strategy.

Analyzes ransomware samples to spot mutex, domain, registry, file, or language kill switches, then vaccinate endpoints with known mutexes and monitor Sysmon/DNS telemetry to block variants before execution.

Validates ransomware recovery plans by simulating restores, measuring RTO/RPO, and confirming data integrity so teams know backup workflows meet resilience goals.

Validates backup integrity via hash manifests, restore tests, and anomaly detection, ensuring recovery readiness for ransomware or disaster response pipelines. Use it in CI/CD backup validation schedules, restore drills, and compliance audits.