Is the recovery order customizable?

While the skill follows a standard dependency-based order (Identity > Databases > Applications), the workflows can be adapted to match your specific business RTOs and Tier 1 system requirements.

Does this skill help with Active Directory restoration?

Yes, it includes specialized procedures for Directory Services Restore Mode (DSRM), double krbtgt password resets to defeat Golden Ticket persistence, and privileged account cleanup.

How does the skill handle backup integrity?

It provides workflows to mount backups in read-only mode and perform automated scans for ransomware artifacts, extensions, and ransom notes before any data is written back to production.

When is the right time to use this ransomware recovery skill?

This skill should be activated after the containment and forensic scoping phases are complete. Using it before the attacker's access has been severed risks immediate re-infection of the recovered systems.

Ransomware Incident Recovery

Name: Ransomware Incident Recovery
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Executes a structured, NIST-aligned recovery process for infrastructure affected by ransomware attacks, ensuring clean restoration and persistence removal.

This skill provides a comprehensive, automated framework for recovering from ransomware incidents based on NIST CSF and CISA guidelines. It guides users through the critical phases of post-attack restoration, including establishing isolated recovery environments, prioritizing Active Directory and identity services, validating backup integrity, and executing a dependency-aware system rebuild. By incorporating essential security steps like double krbtgt password resets and automated persistence scanning, the skill ensures that recovered environments are not only functional but also hardened against re-infection and attacker persistence.

主要功能

01Automated Active Directory restoration and identity hardening procedures

02Pre-restoration backup integrity validation and malware scanning

03NIST CSF 2.0 and CISA framework-aligned recovery workflows

04Prioritized restoration logic based on system dependency chains

054,121 GitHub stars

06Automated persistence mechanism detection for recovered systems

使用场景

01Performing secure Active Directory forest recovery and credential rotation post-compromise

02Developing and validating incident response runbooks during disaster recovery drills

03Restoring mission-critical production systems following a confirmed ransomware encryption event

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills recovering-from-ransomware-attack

For use in Claude.ai and ChatGPT

主要功能

01Automated Active Directory restoration and identity hardening procedures

02Pre-restoration backup integrity validation and malware scanning

03NIST CSF 2.0 and CISA framework-aligned recovery workflows

04Prioritized restoration logic based on system dependency chains

054,121 GitHub stars

06Automated persistence mechanism detection for recovered systems

使用场景

01Performing secure Active Directory forest recovery and credential rotation post-compromise

02Developing and validating incident response runbooks during disaster recovery drills

03Restoring mission-critical production systems following a confirmed ransomware encryption event

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills recovering-from-ransomware-attack

For use in Claude.ai and ChatGPT