- Linux Playbook: 🟡 Partially implemented and actively being expanded
- Windows Playbook: ⚪ Not yet implemented (planned for future updates)
For now, users can reference the Linux folder for the available procedures and automation scripts.
👉 Linux Playbook: ./linux/README.md
The goal of this project is to provide:
- Clear, structured guidance for ransomware incident response
- Practical scripts to support containment, triage, and evidence collection
- Repeatable workflows for SOC and security engineering teams
- Open-source materials for learning, training, and real-world use
- Complete Windows ransomware IR playbook
- Add PowerShell and Bash automation scripts
- Expand forensic and triage procedures
- Add workflow diagrams and response flowcharts
- Improve documentation and examples
Contributions, suggestions, and improvements are welcome!