id: Darkmon - Ransomware Victim Response
version: -1
name: Darkmon - Ransomware Victim Response
description: Triggered when our company surfaces in a Darkmon ransomware mention. Verifies the match, opens a war-room channel via Generic Notify, pages the CISO, and prints next-step guidance for the customer's IR runbook.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- ransomware
- ir
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 324d7be3-c5b0-49c3-977b-eef62d2f7b19
    type: start
    task:
      id: 324d7be3-c5b0-49c3-977b-eef62d2f7b19
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: 0075de46-afca-46fd-8670-7a885de57026
    type: regular
    task:
      id: 0075de46-afca-46fd-8670-7a885de57026
      version: -1
      name: Verify victim name vs customer domains
      description: Reuses the helper script's domain-match logic to confirm the ransomware mention actually names the customer (not a lookalike org).
      scriptName: DarkmonFilterUnseen
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      items:
        simple: ${incident.darkmonvictimname}
      domain_filter_list:
        simple: Darkmon - Customer Domains
      domain_match_field:
        simple: .
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: f567e5f3-0cdb-415b-a425-fe4f56a1c33c
    type: playbook
    task:
      id: f567e5f3-0cdb-415b-a425-fe4f56a1c33c
      version: -1
      name: Open war-room channel
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: 'WAR ROOM: Darkmon ransomware mention'
      Body:
        simple: 'Open the IR war room for incident ${incident.id} - victim: ${incident.darkmonvictimname}, threat actor: ${incident.darkmonthreatactor}.'
      SlackChannel:
        simple: ${inputs.WarRoomChannel}
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: ea33c8c9-e56f-48eb-a145-880799dba04b
    type: playbook
    task:
      id: ea33c8c9-e56f-48eb-a145-880799dba04b
      version: -1
      name: Page CISO
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: 'CRITICAL: Darkmon ransomware mention requires CISO attention'
      Body:
        simple: 'Threat actor ${incident.darkmonthreatactor} listed ${incident.darkmonvictimname} on a leak site. Screenshot: ${incident.darkmonscreenshoturl}.'
      EmailTo:
        simple: ${inputs.CISOEmail}
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '4':
    id: '4'
    taskid: 07d3b2e7-a1d5-4ee1-9f31-cb1980e53a7d
    type: regular
    task:
      id: 07d3b2e7-a1d5-4ee1-9f31-cb1980e53a7d
      version: -1
      name: Print IR runbook hints
      description: ''
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      message:
        simple: 'Next steps (placeholder for customer''s IR runbook): 1) freeze affected segment, 2) snapshot critical systems, 3) engage outside counsel + insurer, 4) preserve evidence chain.'
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: fd6b86db-5f92-4887-999f-ee1121d267c7
    type: title
    task:
      id: fd6b86db-5f92-4887-999f-ee1121d267c7
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: '{"linkLabelsPosition": {}, "paper": {"dimensions": {"height": 1415, "width": 480, "x": 0, "y": 0}}}'
inputs:
- key: CISOEmail
  value:
    simple: ''
  required: true
  description: Mailbox to notify when this playbook fires. Replaces the orphan ${customer_domain} variable so deployments do not silently send to a non-resolving address.
  playbookInputQuery:
- key: WarRoomChannel
  value:
    simple: '#soc-warroom'
  required: false
  description: Slack / Teams channel where SOC discussion of this ransomware victim incident happens. Defaults to
  playbookInputQuery:
outputs: []
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security