Playbook v2 — write case-class-specific playbooks for ransomware/vishing/identity

[Juwon1405]

Goal

senior-analyst-v2.yaml covers 10 case classes in a single playbook. For
deeper specialization, write case-class-focused playbooks that inherit
v2's architectural guarantees but tune sequencing for one scenario.

Proposed bundle

dart_playbook/
├── senior-analyst-v2.yaml                    [base, 845 lines]
├── ransomware-recovery-denial-v1.yaml        [NEW]
├── vishing-initial-access-v1.yaml            [NEW]
├── identity-centric-intrusion-v1.yaml        [NEW]
├── exploit-edge-device-v1.yaml               [NEW]
└── third-party-compromise-v1.yaml            [NEW]

Each ~150-300 lines, focused, citing v2 as the lineage.

Methodology

Each new playbook should:

1. Inherit the architectural posture from v2 (read-only, audit chain, contradictions)
2. Restrict target_case_classes to ONE class
3. Override next_call_decisions to prioritize the relevant evidence sources
4. Add case-specific contradiction_triggers
5. Document the threat model with citations to Mandiant M-Trends 2026 / DFIR Report / CISA advisories

Examples

ransomware-recovery-denial-v1.yaml:

• First call: detect_persistence (look for AD CS template abuse)
• Second: analyze_event_logs (4624/4625 surge on backup hosts)
• Third: detect_defense_evasion (1102 log clear on identity services)
• Contradiction trigger: ransomware_without_recovery_denial_evidence (already in v2)

vishing-initial-access-v1.yaml:

• First call: analyze_windows_logons (look for impossible-travel logins)
• Second: analyze_unix_auth (vishing victims often have hybrid creds)
• Add trigger: mfa_push_fatigue_pattern (3+ rejects then accept within 60s)
• Cite: M-Trends 2026 (vishing 11% of vectors), Scattered Spider TTPs

identity-centric-intrusion-v1.yaml:

• First call: analyze_kerberos_events (Kerberoasting / AS-REP)
• Cite: BlackSuit DFIR Report (Rubeus + Cobalt Strike pattern), Sean Metcalf adsecurity.org

Acceptance

• At least 3 new case-class playbooks
• Each cites specific 2025 case studies
• Each has its own test that demonstrates the routing differs from v2
• Wiki pages: 1 per playbook

[Juwon1405]

Housekeeping: removed the good-first-issue label from this issue because it was contradicting the post-sans label. The post-sans flag stays — this issue is intentionally deferred until after the SANS FIND EVIL! 2026 deadline (2026-06-15). Will re-add good-first-issue after that date. See updated CONTRIBUTING.md for the full policy.