conducting-malware-incident-response

name	conducting-malware-incident-response
description	Use when responding to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment, analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal, worm containment, malware triage, or infected endpoint remediation.
domain	cybersecurity
tags	["malware-response","malware-analysis","eradication","endpoint-remediation","MITRE-ATT&CK"]
subdomain	incident-response
mitre_attack	["T1204","T1027","T1055","T1059","T1486"]
version	1.0.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Conducting Malware Incident Response

Overview

Cybersecurity skill for conducting malware incident response. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "conducting malware incident response"

• "Responds to malware infections across enterprise endpoints by identifying the ma"

• EDR or antivirus detects malware execution on one or more endpoints

• A user reports suspicious system behavior indicative of malware infection

• Threat intelligence indicates a malware campaign targeting the organization's industry

• Network monitoring detects beaconing traffic consistent with known malware C2 patterns

• A file detonation in a sandbox returns a malicious verdict

Do not use for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• EDR platform with process tree visibility and host isolation capability
• Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
• Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
• Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
• Clean system images or gold images for endpoint rebuild
• MITRE ATT&CK framework reference for technique mapping

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}