| name | conducting-malware-incident-response |
| description | Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation. |
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["malware-response","malware-analysis","eradication","endpoint-remediation","MITRE-ATT&CK"] |
| mitre_attack | ["T1204","T1027","T1055","T1059","T1486"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Conducting Malware Incident Response
When to Use
- EDR or antivirus detects malware execution on one or more endpoints
- A user reports suspicious system behavior indicative of malware infection
- Threat intelligence indicates a malware campaign targeting the organization's industry
- Network monitoring detects beaconing traffic consistent with known malware C2 patterns
- A file detonation in a sandbox returns a malicious verdict
Do not use for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.
Prerequisites
- EDR platform with process tree visibility and host isolation capability
- Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
- Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
- Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
- Clean system images or gold images for endpoint rebuild
- MITRE ATT&CK framework reference for technique mapping
Workflow
Step 1: Detect and Confirm Malware Presence
Validate the malware alert and gather initial indicators:
- Review EDR alert details: detection name, file path, hash (SHA-256), process tree
- Check if the detection is a known malware family or generic heuristic detection
- Query the file hash against VirusTotal, MalwareBazaar, and internal threat intelligence
- Examine the process execution chain to determine how the malware was delivered
Detection Summary:
File: C:\Users\jsmith\AppData\Local\Temp\update.exe
SHA-256: a1b2c3d4e5f6...
Detection: CrowdStrike: Malware/Qakbot | VirusTotal: 58/72 engines
Parent: WINWORD.EXE → cmd.exe → powershell.exe → update.exe
Delivery: Email attachment (Invoice-Nov2025.docm)
Network: HTTPS POST to 185.220.101[.]42:443 every 60s
Persistence: Scheduled Task "WindowsUpdate" → update.exe
Step 2: Scope the Infection
Determine how many systems are affected and the malware's propagation method:
- Use EDR to search for the malware hash, filename, and behavioral indicators across all endpoints
- Check for network-based spreading (SMB, WMI, PsExec, exploitation)
- Query email gateway logs for all recipients of the delivery email
- Search for C2 communications to the identified infrastructure from other internal hosts
- Check for persistence mechanisms on all identified infected hosts
Step 3: Contain Infected Systems
Execute containment per the active breach containment procedures:
