What it does. Tests and validates ransomware recovery procedures - backup restore operations Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-ransomware-recovery-procedures, or copy the skill folder into ~/.claude/skills/testing-ransomware-recovery-procedures/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-ransomware-recovery-procedures/SKILL.md

SKILL.md (verbatim)

name: testing-ransomware-recovery-procedures
description: Tests and validates ransomware recovery procedures - backup restore operations
  (e.g. with Restic), RTO/RPO target verification, recovery sequencing, and clean-restore
  validation - to confirm organizational resilience against destructive ransomware attacks.
  Use when validating that recovery plans work under realistic conditions, measuring
  RTO/RPO against business requirements, or testing restore integrity after simulated encryption.
domain: cybersecurity
subdomain: incident-response
tags:
- incident-response
- ransomware
- disaster-recovery
- backup
- rto
- rpo
- resilience
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01
mitre_attack:
- T1486
- T1490
- T1070
- T1078
- T1489
mitre_f3:
  version: '1.1'
  tactics:
  - positioning
  - monetization
  techniques:
  - id: T1531
    name: Account Access Removal
    tactic: positioning
    source: attack
  - id: F1018
    name: Convert to Cryptocurrency
    tactic: monetization
    source: f3
  - id: F1047
    name: Transfer of funds
    tactic: monetization
    source: f3
  - id: F1017.001
    name: 'Conversion to Physical Monetary Instruments: Cash'
    tactic: monetization
    source: f3

Testing Ransomware Recovery Procedures

When to Use

Use this skill when:

• Validating that ransomware recovery plans actually work under realistic conditions
• Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements
• Testing backup restore operations to confirm data integrity and completeness after simulated encryption
• Conducting tabletop exercises or live recovery drills for ransomware scenarios
• Auditing disaster recovery readiness as part of compliance or cyber insurance requirements

Do not use for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.

Prerequisites

• Isolated recovery test environment (air-gapped or network-segmented lab)
• Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)
• Documented RTO/RPO targets per application tier from business impact analysis
• Backup copies available for restore testing (production replicas or test snapshots)
• Recovery runbooks with step-by-step procedures for each critical system

Workflow

Step 1: Define Recovery Test Scope

Identify critical systems and their tiered recovery targets:

Step 2: Prepare Test Environment

# Verify isolated recovery network is segmented
# No routes to production should exist
ip route show | grep -v "192.168.100.0/24"  # recovery VLAN only

# Verify backup catalog is accessible
restic snapshots --repo s3:s3.amazonaws.com/backup-bucket --password-file /etc/restic/pw
# Or for Veeam:
# Get-VBRBackup | Where-Object {$_.JobType -eq "Backup"} | Select Name, LastPointCreationTime

Step 3: Execute Restore and Measure RTO

For each tiered system, measure the full recovery timeline:

1. Detection to Decision - Time from simulated alert to restore decision
2. Backup Locate - Time to identify and select the correct clean restore point
3. Restore Execution - Time to restore data/VM/application from backup
4. Validation - Time to verify data integrity and application functionality
5. Service Restoration - Time until the system is fully operational

Recovery Timeline Measurement:
  T0: Incident declared (simulated ransomware detection)
  T1: Recovery team assembled and backup identified
  T2: Restore initiated from clean backup
  T3: Restore completed, integrity checks passed
  T4: Application validated and service restored

  Actual RTO = T4 - T0
  Actual RPO = T0 - backup_timestamp

Step 4: Validate Data Integrity Post-Restore

# Compare file counts between backup manifest and restored data
find /restored/data -type f | wc -l
# Compare against pre-backup manifest

# Verify database consistency after restore
pg_isready -h localhost -p 5432
psql -c "SELECT count(*) FROM critical_table;" -d restored_db

# Hash verification of critical files
sha256sum /restored/data/critical_config.xml
# Compare against known-good hash from backup manifest

Step 5: Test Credential Rotation and Security Hardening

After restore, validate that security controls are re-established:

1. Rotate all service account passwords and API keys
2. Verify MFA is enabled on all administrative accounts
3. Confirm EDR/AV agents are running and reporting to management console
4. Validate firewall rules block known C2 indicators
5. Check that restored systems have latest security patches

Step 6: Document Results and Calculate Gap

Recovery Test Report:
  System: [Name]
  Tier: [1-4]
  RTO Target: [target]    Actual RTO: [measured]    Gap: [delta]
  RPO Target: [target]    Actual RPO: [measured]    Gap: [delta]
  Data Integrity: [PASS/FAIL]
  Application Validation: [PASS/FAIL]
  Security Controls Restored: [PASS/FAIL]

  Status: [MEETS TARGET / EXCEEDS TARGET / FAILS TARGET]
  Remediation Required: [description if FAILS]

Key Concepts

Tools & Systems

Common Pitfalls

• Not testing restores regularly: Backups that are never tested often fail when needed. Test quarterly at minimum.
• Ignoring recovery sequencing: Restoring an application before its database dependency causes cascading failures.
• Skipping credential rotation: Restored systems may contain compromised credentials that allow re-infection.
• Using production network for testing: Recovery tests on production networks risk spreading simulated or real infections.
• Measuring RTO without WRT: Restore completion is not recovery completion. Include validation and hardening time.
• No immutable backups: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.

References

• NIST SP 800-184: Guide for Cybersecurity Event Recovery
• CISA Ransomware Guide: https://www.cisa.gov/stopransomware
• Veeam RTO/RPO Best Practices: https://www.veeam.com/blog/recovery-time-recovery-point-objectives.html
• NIST CSF 2.0 RC.RP (Recovery Planning)

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Testing Ransomware Recovery Procedures

CLI Usage

# Generate hash manifest for a directory (pre-backup baseline)
python agent.py --hash-dir /data/critical-app -o manifest_baseline.json

# Compare original manifest against restored data
python agent.py --compare manifest_baseline.json manifest_restored.json

# Check if a service is running after restore
python agent.py --check-service postgresql

# Check database connectivity after restore
python agent.py --check-db postgresql:localhost:5432

# Run full recovery drill from config
python agent.py --config drill_config.json -o recovery_report.json

Drill Configuration Format

{
  "systems": [
    {
      "name": "core-database",
      "tier": 1,
      "rto_target_seconds": 3600,
      "rpo_target_seconds": 900,
      "backup_timestamp_epoch": 1711000000,
      "restore_directory": "/restored/core-db",
      "manifest_file": "/manifests/core-db-baseline.json",
      "services": ["postgresql"],
      "database": {
        "type": "postgresql",
        "host": "localhost",
        "port": 5432
      }
    },
    {
      "name": "web-application",
      "tier": 2,
      "rto_target_seconds": 14400,
      "rpo_target_seconds": 3600,
      "restore_directory": "/restored/webapp",
      "services": ["nginx", "gunicorn"]
    }
  ]
}

Recovery Phases Tracked

RTO/RPO Calculation

Actual RTO = service_restored - incident_declared
Actual RPO = incident_declared - backup_timestamp

RTO Met = Actual RTO <= RTO Target
RPO Met = Actual RPO <= RPO Target

Tier Definitions

Hash Manifest Format

{
  "config/app.yaml": "a3f2b8c9d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0",
  "data/users.db": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
  "bin/server": "PERMISSION_DENIED"
}

Validation Checks

Report Output Schema

{
  "report_date": "2026-03-19T12:00:00+00:00",
  "drill_type": "ransomware_recovery_validation",
  "systems_tested": 2,
  "systems_meeting_rto": 2,
  "systems_meeting_rpo": 1,
  "overall_pass": false,
  "results": [
    {
      "system_name": "core-database",
      "tier": 1,
      "rto_target_seconds": 3600,
      "actual_rto_seconds": 2400.5,
      "rto_met": true,
      "rpo_met": true,
      "validations": {},
      "errors": []
    }
  ]
}

References

• NIST SP 800-184: Guide for Cybersecurity Event Recovery
• NIST SP 800-34 Rev 1: Contingency Planning Guide
• CISA Ransomware Guide: https://www.cisa.gov/stopransomware
• Veeam Recovery Best Practices: https://www.veeam.com/blog/recovery-time-recovery-point-objectives.html

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.