/respond-malware

type: Skill
name: respond-malware
description: "Respond to a malware incident following PICERL methodology. Use when malware is detected on endpoints. Orchestrates triage, containment, eradication, and recovery. Works with triage-malware skill for analysis."
required_roles:
  chronicle: roles/chronicle.admin
  soar: roles/chronicle.soarAdmin
  gti: GTI Enterprise
  scc: roles/securitycenter.findingsEditor
personas: [incident-responder]
generated:
  by: human:dandye
  at: 2026-02-04T06:10:49-05:00

Malware Incident Response Skill

Structured workflow for responding to suspected malware incidents using the PICERL model.

Inputs

• `CASE_ID` - SOAR case ID for the incident
• `ALERT_GROUP_IDENTIFIERS` - Alert group identifiers from SOAR
• `INITIAL_INDICATORS` - Details from initial alerts:
• File hashes
• IPs/domains
• Affected hosts
• Affected users

Required Outputs

**After completing each phase, you MUST report these outputs:**

Identification Phase

| Output | Description | |--------|-------------| | `AFFECTED_HOSTS` | Hosts with confirmed malware | | `MALWARE_SAMPLES` | File hashes requiring triage/analysis | | `MALWARE_IOCS` | Network indicators (IPs, domains, URLs) | | `AFFECTED_USERS` | Users who executed/accessed malware |

Containment Phase

| Output | Description | |--------|-------------| | `ISOLATED_HOSTS` | Hosts successfully isolated from network | | `BLOCKED_IOCS` | IOCs blocked at firewall/proxy |

Eradication Phase

| Output | Description | |--------|-------------| | `CLEANED_HOSTS` | Hosts with malware removed | | `REMOVED_PERSISTENCE` | Persistence mechanisms removed |

Recovery Phase

| Output | Description | |--------|-------------| | `RESTORED_HOSTS` | Hosts restored to operational state | | `VALIDATION_STATUS` | Post-recovery scan results |

PICERL Phases

Phase 2: Identification

**Step 2.1: Initial Triage**

Use `/triage-alert` with CASE_ID for initial assessment.

secops-soar.get_case_full_details(case_id=CASE_ID)

Use `/check-duplicates`.

**Step 2.2: Malware Triage**

If file hash is primary indicator:

Use `/triage-malware`:

/triage-malware FILE_HASH=abc123 CASE_ID=1234

This provides:

• GTI classification
• Behavioral indicators
• Network IOCs
• Affected hosts/users

**Step 2.3: IOC Enrichment**

For other key IOCs (IPs, domains, URLs):

Use `/enrich-ioc` for each.

**Step 2.4: Initial Scope Assessment**

Compile:

• `AFFECTED_ENDPOINTS` - Hosts with malware
• `AFFECTED_USERS` - Users who executed/accessed
• `MALICIOUS_IOCs` - Network indicators

Use `/document-in-case` with findings.

---

Phase 3: Containment

**Step 3.1: Endpoint Isolation**

For each endpoint in `AFFECTED_ENDPOINTS`:

Use `/confirm-action`: > "Isolate endpoint [HOSTNAME] from network?"

If confirmed, execute isolation via EDR.

**Step 3.2: Network IOC Containment**

For each IOC in `MALICIOUS_IOCs`:

Use `/confirm-action`: > "Block [IOC_TYPE] [VALUE] at firewall/proxy?"

If confirmed, implement blocks.

**Step 3.3: User Account Containment**

If compromised user involved:

Trigger `/respond-compromised-account`

**Step 3.4: Verify Containment**

Monitor for continued activity:

secops-mcp.search_security_events(
    text="Activity from contained IOCs or endpoints",
    hours_back=1
)

Use `/document-in-case` with containment status.

---

Phase 4: Eradication

**Step 4.1: Identify Persistence**

From `/triage-malware` results and GTI behavior summary, identify:

• Scheduled tasks
• Services installed
• Registry modifications
• Dropped files
• WMI subscriptions

**Step 4.2: Remove Malware & Persistence**

*(Requires EDR/endpoint tools)*

Execute removal plan: 1. Terminate malicious processes 2. Delete malware files 3. Remove persistence mechanisms 4. Clear malicious registry keys

**Step 4.3: Scan for Residual Infection**

*(Requires EDR/AV tools)*

Perform thorough scans post-eradication.

Use `/document-in-case` with eradication results.

---

Phase 5: Recovery

**Step 5.1: Determine Recovery Strategy**

Based on severity and admin rights involved:

| Factor | Rebuild | Clean | |--------|---------|-------| | Admin rights compromised | ✅ | ❌ | | Unknown malware | ✅ | ❌ | | Known commodity malware | Consider | ✅ | | High confidence eradication | Consider | ✅ |

**Step 5.2: Execute Recovery**

*(Involves IT Ops/System Admins)*

• Rebuild from known-good image OR clean existing
• Apply all patches before reconnecting
• Perform vulnerability scan
• Restore data from clean backups if needed

**Step 5.3: Monitor Recovered Systems**

Closely monitor for 24-72 hours post-recovery:

• Watch for re-infection indicators
• Monitor for unusual behavior
• Verify normal operations

**Step 5.4: Lift Containment**

Gradually remove isolation once confidence is high.

Use `/document-in-case` with recovery status.

---

Phase 6: Lessons Learned

Use `/generate-report` with:

• Malware classification
• Entry vector
• Spread/impact
• Response timeline
• Recovery actions
• Recommendations

Conduct review:

• How did malware enter?
• Was detection timely?
• Were containment actions effective?
• What detections should be added?

---

Critical Warnings

• **DO NOT skip** endpoint isolation for confirmed infections
• **MUST identify** malware strain/behavior
• **DO NOT restore** without verifying eradication
• **ALWAYS verify** scan results before reconnecting

Malware Response Quick Reference

| Phase | Key Question | Action | |-------|--------------|--------| | Identification | What is it? | `/triage-malware` | | Identification | Where is it? | SIEM search | | Containment | Stop the spread | Isolate endpoints | | Containment | Block C2 | Block network IOCs | | Eradication | Remove it | EDR remediation | | Recovery | Restore ops | Rebuild or clean |