Darkmon - Ransomware Victim Response

Triggered when our company surfaces in a Darkmon ransomware mention. Verifies the match, opens a war-room channel via Generic Notify, pages the CISO, and prints next-step guidance for the customer's IR runbook.

Darkmon · 6 tasks · 2 inputs · 0 outputs

Details

ID	`Darkmon - Ransomware Victim Response`
From Version	6.8.0
Tasks	6
Tags	darkmon ransomware ir

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Open war-room channel
Page CISO

Integrations

This playbook does not use any integrations.

Scripts

DarkmonFilterUnseen
PrintErrorEntry

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Inputs

CISOEmail — Mailbox to notify when this playbook fires. Replaces the orphan ${customer_domain} variable so deployments do not silently send to a non-resolving address.
WarRoomChannel — Slack / Teams channel where SOC discussion of this ransomware victim incident happens. Defaults to

Flowchart

Source

playbook-Darkmon_Ransomware_Victim_Response.yml

Download History Raw

id: Darkmon - Ransomware Victim Response
version: -1
name: Darkmon - Ransomware Victim Response
description: Triggered when our company surfaces in a Darkmon ransomware mention. Verifies the match, opens a war-room channel via Generic Notify, pages the CISO, and prints next-step guidance for the customer's IR runbook.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- ransomware
- ir
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 324d7be3-c5b0-49c3-977b-eef62d2f7b19
    type: start
    task:
      id: 324d7be3-c5b0-49c3-977b-eef62d2f7b19
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: 0075de46-afca-46fd-8670-7a885de57026
    type: regular
    task:
      id: 0075de46-afca-46fd-8670-7a885de57026
      version: -1
      name: Verify victim name vs customer domains
      description: Reuses the helper script's domain-match logic to confirm the ransomware mention actually names the customer (not a lookalike org).
      scriptName: DarkmonFilterUnseen
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      items:
        simple: ${incident.darkmonvictimname}
      domain_filter_list:
        simple: Darkmon - Customer Domains
      domain_match_field:
        simple: .
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: f567e5f3-0cdb-415b-a425-fe4f56a1c33c
    type: playbook
    task:
      id: f567e5f3-0cdb-415b-a425-fe4f56a1c33c
      version: -1
      name: Open war-room channel
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: 'WAR ROOM: Darkmon ransomware mention'
      Body:
        simple: 'Open the IR war room for incident ${incident.id} - victim: ${incident.darkmonvictimname}, threat actor: ${incident.darkmonthreatactor}.'
      SlackChannel:
        simple: ${inputs.WarRoomChannel}
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: ea33c8c9-e56f-48eb-a145-880799dba04b
    type: playbook
    task:
      id: ea33c8c9-e56f-48eb-a145-880799dba04b
      version: -1
      name: Page CISO
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: 'CRITICAL: Darkmon ransomware mention requires CISO attention'
      Body:
        simple: 'Threat actor ${incident.darkmonthreatactor} listed ${incident.darkmonvictimname} on a leak site. Screenshot: ${incident.darkmonscreenshoturl}.'
      EmailTo:
        simple: ${inputs.CISOEmail}
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '4':
    id: '4'
    taskid: 07d3b2e7-a1d5-4ee1-9f31-cb1980e53a7d
    type: regular
    task:
      id: 07d3b2e7-a1d5-4ee1-9f31-cb1980e53a7d
      version: -1
      name: Print IR runbook hints
      description: ''
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      message:
        simple: 'Next steps (placeholder for customer''s IR runbook): 1) freeze affected segment, 2) snapshot critical systems, 3) engage outside counsel + insurer, 4) preserve evidence chain.'
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: fd6b86db-5f92-4887-999f-ee1121d267c7
    type: title
    task:
      id: fd6b86db-5f92-4887-999f-ee1121d267c7
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: '{"linkLabelsPosition": {}, "paper": {"dimensions": {"height": 1415, "width": 480, "x": 0, "y": 0}}}'
inputs:
- key: CISOEmail
  value:
    simple: ''
  required: true
  description: Mailbox to notify when this playbook fires. Replaces the orphan ${customer_domain} variable so deployments do not silently send to a non-resolving address.
  playbookInputQuery:
- key: WarRoomChannel
  value:
    simple: '#soc-warroom'
  required: false
  description: Slack / Teams channel where SOC discussion of this ransomware victim incident happens. Defaults to
  playbookInputQuery:
outputs: []
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security