/conducting-malware-incident-response

name: conducting-malware-incident-response
description: 'Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection
  vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment,
  analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal,
  worm containment, malware triage, or infected endpoint remediation.

  '
domain: cybersecurity
subdomain: incident-response
tags:
- malware-response
- malware-analysis
- eradication
- endpoint-remediation
- MITRE-ATT&CK
mitre_attack:
- T1204
- T1027
- T1055
- T1059
- T1486
version: 1.0.0
author: mahipal
license: Apache-2.0
d3fend_techniques:
- File Metadata Consistency Validation
- Application Protocol Command Analysis
- Identifier Analysis
- Content Format Conversion
- Message Analysis
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01

Conducting Malware Incident Response

When to Use

• EDR or antivirus detects malware execution on one or more endpoints
• A user reports suspicious system behavior indicative of malware infection
• Threat intelligence indicates a malware campaign targeting the organization's industry
• Network monitoring detects beaconing traffic consistent with known malware C2 patterns
• A file detonation in a sandbox returns a malicious verdict

**Do not use** for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.

Prerequisites

• EDR platform with process tree visibility and host isolation capability
• Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
• Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
• Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
• Clean system images or gold images for endpoint rebuild
• MITRE ATT&CK framework reference for technique mapping

Workflow

Step 1: Detect and Confirm Malware Presence

Validate the malware alert and gather initial indicators:

• Review EDR alert details: detection name, file path, hash (SHA-256), process tree
• Check if the detection is a known malware family or generic heuristic detection
• Query the file hash against VirusTotal, MalwareBazaar, and internal threat intelligence
• Examine the process execution chain to determine how the malware was delivered

Detection Summary:
File:        C:\Users\jsmith\AppData\Local\Temp\update.exe
SHA-256:     a1b2c3d4e5f6...
Detection:   CrowdStrike: Malware/Qakbot | VirusTotal: 58/72 engines
Parent:      WINWORD.EXE → cmd.exe → powershell.exe → update.exe
Delivery:    Email attachment (Invoice-Nov2025.docm)
Network:     HTTPS POST to 185.220.101[.]42:443 every 60s
Persistence: Scheduled Task "WindowsUpdate" → update.exe

Step 2: Scope the Infection

Determine how many systems are affected and the malware's propagation method:

• Use EDR to search for the malware hash, filename, and behavioral indicators across all endpoints
• Check for network-based spreading (SMB, WMI, PsExec, exploitation)
• Query email gateway logs for all recipients of the delivery email
• Search for C2 communications to the identified infrastructure from other internal hosts
• Check for persistence mechanisms on all identified infected hosts

Step 3: Contain Infected Systems

Execute containment per the active breach containment procedures:

• Network-isolate infected endpoints via EDR containment
• Block malware C2 infrastructure at firewall and DNS
• Block the malware hash in EDR prevention policy organization-wide
• Quarantine the delivery email from all mailboxes (if email-delivered)
• Disable compromised user accounts if credential theft is suspected

Step 4: Analyze the Malware

Perform sufficient analysis to support complete eradication:

• Submit the sample to a sandbox for dynamic analysis (behavioral report, dropped files, network IOCs)
• Identify all persistence mechanisms: registry keys, scheduled tasks, services, WMI subscriptions, startup folders
• Document all file system artifacts: dropped files, modified files, created directories
• Extract network IOCs: C2 domains, IPs, URLs, user agents, JA3/JA3S hashes
• Map observed behaviors to MITRE ATT&CK techniques

Malware Analysis Summary - Qakbot Variant
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Initial Access:   T1566.001 - Spearphishing Attachment (.docm)
Execution:        T1059.001 - PowerShell (encoded downloader)
Persistence:      T1053.005 - Scheduled Task
Defense Evasion:  T1055.012 - Process Hollowing (explorer.exe)
C2:               T1071.001 - HTTPS with custom headers
Collection:       T1005 - Data from Local System (browser credentials)
Exfiltration:     T1041 - Exfiltration Over C2 Channel

Artifacts:
- C:\Users\*\AppData\Local\Temp\update.exe (dropper)
- C:\ProgramData\Microsoft\{GUID}\config.dll (payload)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\{random} (backup persistence)
- Scheduled Task: "WindowsUpdate" (primary persistence)

Step 5: Eradicate the Malware

Remove all malware artifacts from every infected system:

• Terminate malicious processes and injected threads
• Delete malware files from all identified paths
• Remove persistence mechanisms (scheduled tasks, registry keys, services, WMI subscriptions)
• Clear browser credential stores if credential harvesting was confirmed
• Run a full EDR scan to verify no artifacts remain
• If eradication confidence is low, reimage the system from a known-clean gold image

Step 6: Recover and Validate

Restore systems to production and verify clean status:

• Reconnect contained systems to the network in stages
• Monitor for 72 hours for any recurrence of malware indicators
• Force password resets for all users on infected endpoints
• Verify that C2 traffic has completely ceased across the environment
• Update detection rules based o