| name | conducting-malware-incident-response |
| description | Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment, analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal, worm containment, malware triage, or infected endpoint remediation.
|
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["malware-response","malware-analysis","eradication","endpoint-remediation","MITRE-ATT&CK"] |
| mitre_attack | ["T1204","T1027","T1055","T1059","T1486"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Conducting Malware Incident Response
When to Use
- EDR or antivirus detects malware execution on one or more endpoints
- A user reports suspicious system behavior indicative of malware infection
- Threat intelligence indicates a malware campaign targeting the organization's industry
- Network monitoring detects beaconing traffic consistent with known malware C2 patterns
- A file detonation in a sandbox returns a malicious verdict
Do not use for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.
Common Misconfigurations & Verification
- Eradicating before capturing volatile state: killing/quarantining the binary or reimaging before a memory dump destroys the only copy of fileless/injected payloads, beacon config, and stolen creds. Isolate via EDR → capture memory → then eradicate.
- Containment that tips off the actor / breaks persistence cleanup: blocking only the known C2 IP lets a Malleable-C2 domain or backup channel survive, and the actor reacts. Block all extracted C2 (IPs, domains, JA3) and quarantine the email simultaneously rather than piecemeal.
- Missing secondary stages and backup persistence: loaders like Emotet/Qakbot drop Cobalt Strike and install multiple persistence (Run key + scheduled task + WMI subscription + service). Removing one guarantees reinfection — enumerate all of them from the sandbox report and across every infected host.
- Scoping by hash alone: the hash recompiles per host; sweep on durable behaviors (named pipe, mutex, task name, parent-child chain) too.
Verify eradication actually held: after cleanup, confirm C2 traffic has fully ceased across the whole estate (not just the patient-zero host), confirm persistence is gone after a reboot (re-scan scheduled tasks/Run keys/services/WMI), confirm rotated credentials reject the old password, and monitor for 72 hours for recurrence before declaring recovered.
Prerequisites
- EDR platform with process tree visibility and host isolation capability
- Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
- Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
- Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
- Clean system images or gold images for endpoint rebuild
- MITRE ATT&CK framework reference for technique mapping
Workflow
Step 1: Detect and Confirm Malware Presence
Validate the malware alert and gather initial indicators:
