PCTAMALOU

🔬 Mission pratique – Laboratoire (2 heures)

Architecture du Lab Playbook

⚠️ Préparation de l'Environnement

Étapes Détaillées de Création

Étape 1 : Simulation d'un Incident Ransomware

# Sur la machine cible Ubuntu (avec agent Wazuh)
cd /tmp

# Création de fichiers de test
mkdir -p test_data/{documents,images,backups}
for i in {1..50}; do 
    echo "Fichier test $i" > test_data/documents/doc_$i.txt
done

# Simulation d'activité suspecte (modification massive)
# Cela déclenchera des alertes FIM (File Integrity Monitoring) dans Wazuh
find test_data/ -type f -exec touch {} \;

# Création d'une note de rançon simulée
cat > RANSOM_NOTE_README.txt << 'EOF'
!!! VOS FICHIERS ONT ÉTÉ CHIFFRÉS !!!

Pour récupérer vos fichiers, vous devez payer 0.1 BTC à l'adresse :
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Ne tentez pas de restaurer depuis backup - nous les avons aussi chiffrés.
Contact : decrypt2026@onionmail.com

!!! YOUR FILES HAVE BEEN ENCRYPTED !!!
EOF

# Simulation d'un processus suspect (cryptomining)
echo "Simulating crypto mining activity..."
timeout 30 bash -c 'while true; do echo "mining..."; sleep 1; done' &
MINER_PID=$!

# Enregistrer l'ID du processus pour nettoyage
echo $MINER_PID > /tmp/simulated_miner.pidCopier

Étape 2 : Création du Playbook Structuré

mkdir -p ~/mon_lab/playbooks/{ransomware,phishing,malware,ddos}
cd ~/mon_lab/playbooks/ransomware
mkdir -p {scripts,templates,checklists,evidence}

# playbook_ransomware.yaml - Version structurée
metadata:
  id: IR-PLAYBOOK-RANSOMWARE-001
  version: "1.0"
  created: "2026-01-15"
  last_updated: "2026-01-15"
  author: "Équipe SOC PCTAMALOU"
  classification: "CONFIDENTIEL - INTERNE"
  mttd_target: "30 minutes"
  mttr_target: "4 heures"

trigger_conditions:
  - "Alerte Wazuh: Multiple file modifications in short time"
  - "Alerte Wazuh: RANSOM_NOTE file detected"
  - "Alerte Wazuh: Crypto mining process detected"
  - "User report: Cannot access files, ransom note present"

mitre_attack_mapping:
  tactic: "TA0040 - Impact"
  technique: "T1486 - Data Encrypted for Impact"
  subtechnique: "T1486.001 - Data Encrypted for Impact via Ransomware"

roles_responsibilities:
  tier1_soc: "Initial triage, containment actions"
  tier2_analyst: "Deep investigation, eradication"
  incident_manager: "Coordination, communication"
  system_admin: "Recovery, system restoration"

phases:
  preparation:
    prerequisites:
      - "Wazuh agents installed on all endpoints"
      - "Backup system tested and verified"
      - "Isolation procedures documented"
    tools_required:
      - "Wazuh SIEM"
      - "Kibana dashboards"
      - "Network isolation scripts"
      - "Forensic toolkit"

  detection_analysis:
    step_1_initial_triage:
      action: "Verify alert legitimacy"
      commands:
        - "ssh admin@{{affected_host}} 'ls -la /tmp/ | grep -i ransom'"
        - "ssh admin@{{affected_host}} 'ps aux | grep -i crypt\|miner'"
      success_criteria: "Confirm ransomware activity"
      escalation: "If confirmed → escalate to tier2"

    step_2_scope_assessment:
      action: "Determine scope of infection"
      commands:
        - "wazuh-cli -d /var/ossec/logs/alerts/alerts.json | grep '{{affected_host}}'"
        - "Check Wazuh agent connectivity: systemctl status wazuh-agent"
      evidence_collection:
        - "Screenshot: Kibana alert details"
        - "Logs: /var/ossec/logs/alerts/alerts.json"
        - "Timeline: Infection timeline estimation"

  containment_eradication:
    step_1_network_isolation:
      action: "Isolate affected host"
      immediate_actions:
        - "Wazuh active response: /var/ossec/active-response/bin/firewall-drop.sh"
        - "Manual isolation: sudo iptables -A OUTPUT -j DROP"
        - "VLAN quarantine: Move to isolated VLAN 999"
      success_criteria: "Host cannot communicate externally"

    step_2_malware_eradication:
      action: "Identify and remove malware"
      commands:
        - "ssh admin@{{affected_host}} 'kill $(cat /tmp/simulated_miner.pid)'"
        - "ssh admin@{{affected_host}} 'rm -f /tmp/RANSOM_NOTE*.txt'"
        - "ssh admin@{{affected_host}} 'find /tmp -name \"*crypt*\" -delete'"
      persistence_check:
        - "Check cron jobs: crontab -l"
        - "Check systemd services: systemctl list-units --all"
        - "Check startup scripts: ls -la /etc/init.d/"

  recovery:
    step_1_data_restoration:
      action: "Restore from backups"
      commands:
        - "Verify backup integrity: sha256sum /backups/latest.tar.gz"
        - "Restore: tar -xzf /backups/latest.tar.gz -C /"
        - "Validate: diff -r /restored_data /original_data"
      validation: "All critical files restored and accessible"

    step_2_system_hardening:
      action: "Apply security patches"
      commands:
        - "sudo apt update && sudo apt upgrade -y"
        - "Review firewall rules: sudo ufw status verbose"
        - "Update Wazuh rules: sudo wazuh-cli -u"

  post_incident:
    step_1_documentation:
      action: "Complete incident report"
      template: "templates/incident_report.md"
      data_to_include:
        - "Timeline of events"
        - "Actions taken"
        - "Root cause analysis"
        - "Cost estimation"

    step_2_lessons_learned:
      action: "Update playbooks and detection rules"
      improvements:
        - "Add new Wazuh rules for earlier detection"
        - "Update backup procedures"
        - "Conduct team training on updated playbook"

communication_templates:
  initial_notification:
    subject: "🚨 INCIDENT RANSOMWARE DÉTECTÉ - Action Immédiate Requise"
    body: |
      Un incident ransomware a été détecté sur l'hôte {{affected_host}}.
      Heure de détection: {{detection_time}}
      Actions en cours: Isolation et investigation
      Prochaine mise à jour dans: 30 minutes

  status_update:
    subject: "🔄 MISE À JOUR INCIDENT RANSOMWARE - {{status}}"
    body: |
      Statut: {{current_status}}
      Progrès: {{progress_percentage}}%
      Prochaines étapes: {{next_steps}}
      ETR (Estimated Time to Resolution): {{etr}}

  resolution_notification:
    subject: "✅ INCIDENT RANSOMWARE RÉSOLU - Rapport Complet"
    body: |
      L'incident ransomware a été résolu.
      Temps total de résolution: {{resolution_time}}
      Impact: {{impact_assessment}}
      Actions préventives: {{preventive_measures}}

checklists:
  containment_checklist:
    - [ ] Host isolated from network
    - [ ] Malicious processes terminated
    - [ ] Persistence mechanisms removed
    - [ ] Initial evidence collected

  recovery_checklist:
    - [ ] Backups verified and intact
    - [ ] Data restored successfully
    - [ ] System patched and updated
    - [ ] Security controls strengthened

  closure_checklist:
    - [ ] All detection gaps addressed
    - [ ] Playbook updated with lessons learned
    - [ ] Team debrief completed
    - [ ] Executive summary delivered

scripts:
  isolation_script: "scripts/isolate_host.sh"
  investigation_script: "scripts/collect_evidence.py"
  restoration_script: "scripts/restore_from_backup.sh"

success_criteria:
  - "No malicious activity detected for 72 hours"
  - "All affected systems restored to operational state"
  - "Detection rules updated to prevent recurrence"
  - "Post-incident report completed and approved"Copier

Étape 3 : Scripts d'Automatisation

#!/bin/bash
# scripts/isolate_host.sh
# Script d'isolation automatique pour Wazuh Active Response

HOST=$1
LOG_FILE="/var/log/ransomware_isolation.log"

log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> $LOG_FILE
}

log_message "Début isolation pour $HOST"

# 1. Bloquer toutes les communications sortantes
iptables -I OUTPUT -s $HOST -j DROP 2>/dev/null || true
log_message "IPTables OUTPUT rule added for $HOST"

# 2. Bloquer les communications entrantes
iptables -I INPUT -d $HOST -j DROP 2>/dev/null || true
log_message "IPTables INPUT rule added for $HOST"

# 3. Arrêter les services réseau (si SSH disponible)
ssh admin@$HOST "sudo systemctl stop networking 2>/dev/null || true" && \
log_message "Networking stopped on $HOST" || \
log_message "Could not stop networking on $HOST"

# 4. Collecter les preuves avant isolation complète
EVIDENCE_DIR="/evidence/$HOST/$(date +%Y%m%d_%H%M%S)"
mkdir -p $EVIDENCE_DIR

# 5. Sauvegarder les règles actuelles
iptables-save > $EVIDENCE_DIR/iptables_backup.rules
netstat -tupan > $EVIDENCE_DIR/network_connections.txt

log_message "Isolation complétée pour $HOST"
echo "Host $HOST has been isolated. Evidence saved to $EVIDENCE_DIR"

Étape 4 : Test et Validation du Playbook

# Script de test automatisé
#!/bin/bash
# test_playbook.sh

echo "🧪 Début du test du playbook ransomware"
echo "========================================"

# Simuler l'alerte
ALERT_TIME=$(date '+%Y-%m-%d %H:%M:%S')
echo "🕒 Temps de détection: $ALERT_TIME"

# Phase 1: Détection & Analyse (cible: < 15 min)
echo "🔍 Phase 1 - Détection & Analyse"
start_time=$SECONDS
# Simuler les commandes d'analyse
sleep 2
echo "   ✅ Alerte confirmée: Ransomware détecté"
detection_time=$((SECONDS - start_time))
echo "   ⏱️  Temps de détection: ${detection_time}s"

# Phase 2: Confinement (cible: < 10 min)
echo "🚧 Phase 2 - Confinement"
start_time=$SECONDS
./scripts/isolate_host.sh 192.168.56.101
sleep 3
echo "   ✅ Hôte isolé du réseau"
containment_time=$((SECONDS - start_time))
echo "   ⏱️  Temps de confinement: ${containment_time}s"

# Calculer le MTTR
total_mttr=$((detection_time + containment_time))
echo ""
echo "📊 RÉSULTATS DU TEST"
echo "===================="
echo "MTTD (Detection): ${detection_time}s"
echo "MTTR (Response): ${total_mttr}s"
echo "Cible atteinte: $( [ $total_mttr -lt 900 ] && echo "✅" || echo "❌" )"

# Générer un rapport de test
cat > test_report.md << EOF
# Rapport de Test Playbook Ransomware
## Résumé
- Date du test: $(date)
- MTTR total: ${total_mttr} secondes
- Statut: $( [ $total_mttr -lt 900 ] && echo "SUCCÈS" || echo "ÉCHEC" )

## Améliorations identifiées
1. Automatiser la collecte de preuves
2. Ajouter des commandes de diagnostic réseau
3. Créer des templates d'email automatisés

## Prochaines étapes
- Mettre à jour le playbook avec les leçons apprises
- Tester avec un scénario plus complexe
- Intégrer avec TheHive pour gestion de cas
EOF

echo "📄 Rapport généré: test_report.md"Copier

Exercice Avancé : Intégration avec TheHive

{
  "name": "Ransomware Response Template",
  "description": "Template pour incidents ransomware",
  "tasks": [
    {
      "title": "Initial Triage",
      "description": "Vérifier l'alerte et confirmer l'incident",
      "status": "Waiting"
    },
    {
      "title": "Containment",
      "description": "Isoler l'hôte affecté",
      "status": "Waiting"
    },
    {
      "title": "Evidence Collection",
      "description": "Collecter les preuves pour analyse forensique",
      "status": "Waiting"
    }
  ],
  "customFields": {
    "mitreTactic": "TA0040",
    "mitreTechnique": "T1486",
    "severity": "Critical"
  }
}