Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Testing Ransomware Recovery Procedures · mukul975 | DecimalAI

Testing Ransomware Recovery Procedures

SkillScore55Maintained

testing-ransomware-recovery-procedures

Test and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/testing-ransomware-recovery-procedures/SKILL.md

decimalai skills pull testing-ransomware-recovery-procedures --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/testing-ransomware-recovery-procedures/SKILL.md https://app.decimal.ai/s/testing-ransomware-recovery-procedures/SKILL.md

Raw file: /s/testing-ransomware-recovery-procedures/SKILL.md ↗ · machine-readable summary at /s/testing-ransomware-recovery-procedures.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 54d ago

Yes — +50% lift · at higher cost+41% tokens0% turns55% of whole cases pass with skill (12/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-09	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-08	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/testing-ransomware-recovery-procedures/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Testing Ransomware Recovery Procedures

When to Use

Use this skill when:

Validating that ransomware recovery plans actually work under realistic conditions
Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements
Testing backup restore operations to confirm data integrity and completeness after simulated encryption
Conducting tabletop exercises or live recovery drills for ransomware scenarios
Auditing disaster recovery readiness as part of compliance or cyber insurance requirements

Do not use for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.

Prerequisites

Isolated recovery test environment (air-gapped or network-segmented lab)
Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)
Documented RTO/RPO targets per application tier from business impact analysis
Backup copies available for restore testing (production replicas or test snapshots)
Recovery runbooks with step-by-step procedures for each critical system

Workflow

Step 1: Define Recovery Test Scope

Identify critical systems and their tiered recovery targets:

| Tier | System Type | RTO Target | RPO Target | Example | |------|------------|------------|------------|---------| | Tier 1 | Mission-critical | < 1 hour | < 15 min | Active Directory, core database | | Tier 2 | Business-critical | < 4 hours | < 1 hour | ERP, email, CRM | | Tier 3 | Business-operational | < 24 hours | < 4 hours | File shares, internal apps | | Tier 4 | Non-critical | < 72 hours | < 24 hours | Dev/test, analytics |

Step 2: Prepare Test Environment

bash
# Verify isolated recovery network is segmented
# No routes to production should exist
ip route show | grep -v "192.168.100.0/24"  # recovery VLAN only

# Verify backup catalog is accessible
restic snapshots --repo s3:s3.amazonaws.com/backup-bucket --password-file /etc/restic/pw
# Or for Veeam:
# Get-VBRBackup | Where-Object {$_.JobType -eq "Backup"} | Select Name, LastPointCreationTime

Step 3: Execute Restore and Measure RTO

For each tiered system, measure the full recovery timeline:

Detection to Decision - Time from simulated alert to restore decision
Backup Locate - Time to identify and select the correct clean restore point
Restore Execution - Time to restore data/VM/application from backup
Validation - Time to verify data integrity and application functionality
Service Restoration - Time until the system is fully operational

Recovery Timeline Measurement:
  T0: Incident declared (simulated ransomware detection)
  T1: Recovery team assembled and backup identified
  T2: Restore initiated from clean backup
  T3: Restore completed, integrity checks passed
  T4: Application validated and service restored

  Actual RTO = T4 - T0
  Actual RPO = T0 - backup_timestamp

Step 4: Validate Data Integrity Post-Restore

bash
# Compare file counts between backup manifest and restored data
find /restored/data -type f | wc -l
# Compare against pre-backup manifest

# Verify database consistency after restore
pg_isready -h localhost -p 5432
psql -c "SELECT count(*) FROM critical_table;" -d restored_db

# Hash verification of critical files
sha256sum /restored/data/critical_config.xml
# Compare against known-good hash from backup manifest

Step 5: Test Credential Rotation and Security Hardening

After restore, validate that security controls are re-established:

Rotate all service account passwords and API keys
Verify MFA is enabled on all administrative accounts
Confirm EDR/AV agents are running and reporting to management console
Validate firewall rules block known C2 indicators
Check that restored systems have latest security patches

Step 6: Document Results and Calculate Gap

Recovery Test Report:
  System: [Name]
  Tier: [1-4]
  RTO Target: [target]    Actual RTO: [measured]    Gap: [delta]
  RPO Target: [target]    Actual RPO: [measured]    Gap: [delta]
  Data Integrity: [PASS/FAIL]
  Application Validation: [PASS/FAIL]
  Security Controls Restored: [PASS/FAIL]

  Status: [MEETS TARGET / EXCEEDS TARGET / FAILS TARGET]
  Remediation Required: [description if FAILS]

Key Concepts

| Term | Definition | |------|-----------| | RTO | Recovery Time Objective: maximum acceptable downtime for a system after a disaster | | RPO | Recovery Point Objective: maximum acceptable data loss measured in time | | WRT | Work Recovery Time: time to verify system integrity after restore completes | | MTD | Maximum Tolerable Downtime: absolute limit before unacceptable business impact | | Clean Restore Point | A backup verified to be free of ransomware artifacts or encryption | | Recovery Sequencing | The order in which interdependent systems must be restored | | Air-Gapped Backup | Backup stored on media physically disconnected from the network |

Tools & Systems

| Tool | Purpose | |------|---------| | Veeam Backup & Replication | VM and physical server backup and restore | | Commvault | Enterprise data protection and recovery orchestration | | Rubrik | Cloud-native backup with ransomware recovery SLA | | AWS Backup | Centralized backup for AWS services | | Azure Backup | Microsoft cloud backup with immutable vault | | Restic | Open-source encrypted backup tool | | Velero | Kubernetes cluster backup and restore |

Common Pitfalls

Not testing restores regularly: Backups that are never tested often fail when needed. Test quarterly at minimum.
Ignoring recovery sequencing: Restoring an application before its database dependency causes cascading failures.
Skipping credential rotation: Restored systems may contain compromised credentials that allow re-infection.
Using production network for testing: Recovery tests on production networks risk spreading simulated or real infections.
Measuring RTO without WRT: Restore completion is not recovery completion. Include validation and hardening time.
No immutable backups: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.

References

NIST SP 800-184: Guide for Cybersecurity Event Recovery
CISA Ransomware Guide: https://www.cisa.gov/stopransomware
Veeam RTO/RPO Best Practices: https://www.veeam.com/blog/recovery-time-recovery-point-objectives.html
NIST CSF 2.0 RC.RP (Recovery Planning)

Illustrative Want to see what testing-ransomware-recovery-procedures would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 12:15 UTC · 22 cases

Lift

+50%

55% vs 5%

Agent turns

1.0 vs 1.0

Tokens

+41%

3,252.59 vs 2,302.64

fail → pass · 11pass → pass · 1fail → fail · 10

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-09 Before restoring backups in our recovery lab, an engineer suggests pinging production subnets to check connectivity. What CLI command and check should be performed on the test node to verify network isolation?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are defining SLA targets for our core Active Directory and central authentication databases during ransomware drill scenarios. Management suggests setting RTO to 4 hours and RPO to 1 hour, similar to general web applications. How should Tier 1 mission-critical recovery targets be structured?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We use Restic for encrypted offsite backups stored in AWS S3. Our team wants to manually inspect S3 folder objects through AWS CLI to verify snapshot existence prior to restoring. What Restic command checks snapshot availability directly?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 A company relies entirely on automated nightly disk snapshots replicated to an online secondary SAN for ransomware protection. Why is this architecture prone to total recovery failure during a real ransomware attack?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Our IT ops team proposes setting Tier 3 internal file shares and non-essential tools to a 1-hour RTO during ransomware drill scoping. What are the standard Tier 3 business-operational RTO and RPO targets?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We need to design a tabletop and live recovery drill plan for our core enterprise systems following a simulated ransomware attack. Please provide a step-by-step procedure covering environment preparation, timeline tracking phases from detection through service restoration, post-restore data integrity validation checks, and post-recovery security hardening steps. Include a standardized report template to summarize actual versus targeted recovery metrics.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 In our drill report, a developer suggests calculating RTO simply as the time taken during data transfer from S3 (T3 minus T2). How should total Actual RTO be calculated across the entire drill timeline?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Once a system is restored and data integrity checks pass during a ransomware drill, a sysadmin wants to immediately hand the system back to production users. What critical credential maintenance step must occur before declaring the system safe?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 An organization performs ransomware backup restore testing once every two years during major infrastructure upgrades. What recommended minimum testing frequency prevents unnoticed backup failures?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We isolated an infected VM snapshot after a ransomware breach. How do we perform deep memory forensics, artifact extraction, and threat actor attribution using Volatility to find the initial entry vector?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Following data restoration in a ransomware recovery drill, an auditor asks how we ensure the restored VM won't immediately re-connect to attacker command-and-control infrastructure or run unpatched vulnerabilities. What security hardening checks are required?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our team needs to evaluate our ransomware backup recovery performance across different application criticality levels. Could you outline a framework for setting up an isolated recovery environment, measuring key metrics like RTO and RPO during a restore exercise, validating database and file integrity post-restore, and producing a formal recovery report showing variance calculations?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 During an executive briefing on recovery metrics, a manager asks why our total downtime exceeded the backup restore time. How is Work Recovery Time (WRT) defined in relation to raw data restore time?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 After restoring file assets to /restored/data, an engineer suggests opening a few random text files manually to confirm restore success. How should critical configuration files like /restored/data/critical_config.xml be mathematically validated for exact integrity against the backup manifest?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are deploying a new backup system and need to design the daily backup schedule, storage retention policy, and GFS rotation scheme for our main database. Can you design the backup creation retention architecture?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 During a ransomware drill, engineers restored all application web servers simultaneously before initiating Active Directory or database restoration, causing widespread boot connection errors. What key recovery principle was violated?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 In a Veeam-protected environment, an engineer wants to check backup job creation times via PowerShell prior to restore execution during a drill. What Veeam cmdlet filter sequence is used?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Our team completed a drill where Tier 1 database restoration took 2 hours against a 1-hour RTO target, though data integrity passed. What status classification and follow-up must be assigned in the recovery test report?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are currently experiencing an active ransomware outbreak across our primary data center with files actively encrypting on production servers. Should we follow this testing and drill skill to perform recovery testing now?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 I am setting up a periodic ransomware restore validation exercise in a segmented lab environment. Can you give me a structured checklist and workflow that guides us through defining scope across application tiers, verifying network isolation, tracking key recovery milestones, executing post-restore consistency checks, and performing credential rotation prior to system handoff?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 When reporting RPO after restoring a database snapshot during a ransomware exercise, an engineer proposes using the duration of the backup job itself. How is Actual RPO correctly calculated?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 After restoring a PostgreSQL database service during a ransomware drill, a technician proposes simply pinging the server IP to verify recovery. What specific PostgreSQL CLI commands verify service readiness and query row counts on restored critical tables?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +50 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 54.6%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 12:15 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run55

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+29% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Testing Ransomware Recovery Procedures

SkillSafety

Source

Testing Ransomware Recovery Procedures

When to Use

Prerequisites

Workflow

Step 1: Define Recovery Test Scope

Step 2: Prepare Test Environment

Step 3: Execute Restore and Measure RTO

Step 4: Validate Data Integrity Post-Restore

Step 5: Test Credential Rotation and Security Hardening

Step 6: Document Results and Calculate Gap

Key Concepts

Tools & Systems

Common Pitfalls

References

How this skill was measured

Related skills