/conducting-malware-incident-response

name: conducting-malware-incident-response
description: Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.
domain: cybersecurity
subdomain: incident-response
tags:
- malware-response
- malware-analysis
- eradication
- endpoint-remediation
- MITRE-ATT&CK
mitre_attack:
- T1204
- T1027
- T1055
- T1059
- T1486
version: 1.0.0
author: mahipal
license: Apache-2.0
d3fend_techniques:
- File Metadata Consistency Validation
- Application Protocol Command Analysis
- Identifier Analysis
- Content Format Conversion
- Message Analysis
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01

Conducting Malware Incident Response

When to Use

• EDR or antivirus detects malware execution on one or more endpoints
• A user reports suspicious system behavior indicative of malware infection
• Threat intelligence indicates a malware campaign targeting the organization's industry
• Network monitoring detects beaconing traffic consistent with known malware C2 patterns
• A file detonation in a sandbox returns a malicious verdict

**Do not use** for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.

Prerequisites

• EDR platform with process tree visibility and host isolation capability
• Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
• Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
• Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
• Clean system images or gold images for endpoint rebuild
• MITRE ATT&CK framework reference for technique mapping

Workflow

Step 1: Detect and Confirm Malware Presence

Validate the malware alert and gather initial indicators:

• Review EDR alert details: detection name, file path, hash (SHA-256), process tree
• Check if the detection is a known malware family or generic heuristic detection
• Query the file hash against VirusTotal, MalwareBazaar, and internal threat intelligence
• Examine the process execution chain to determine how the malware was delivered

Detection Summary:
File:        C:\Users\jsmith\AppData\Local\Temp\update.exe
SHA-256:     a1b2c3d4e5f6...
Detection:   CrowdStrike: Malware/Qakbot | VirusTotal: 58/72 engines
Parent:      WINWORD.EXE → cmd.exe → powershell.exe → update.exe
Delivery:    Email attachment (Invoice-Nov2025.docm)
Network:     HTTPS POST to 185.220.101[.]42:443 every 60s
Persistence: Scheduled Task "WindowsUpdate" → update.exe

Step 2: Scope the Infection

Determine how many systems are affected and the malware's propagation method:

• Use EDR to search for the malware hash, filename, and behavioral indicators across all endpoints
• Check for network-based spreading (SMB, WMI, PsExec, exploitation)
• Query email gateway logs for all recipients of the delivery email
• Search for C2 communications to the identified infrastructure from other internal hosts
• Check for persistence mechanisms on all identified infected hosts

Step 3: Contain Infected Systems

Execute containment per the active breach containment procedures:

• Network-isolate infected endpoints via EDR containment
• Block malware C2 infrastructure at firewall and DNS
• Block the malware hash in EDR prevention policy organization-wide
• Quarantine the delivery email from all mailboxes (if email-delivered)
• Disable compromised user accounts if credential theft is suspected

Step 4: Analyze the Malware

Perform sufficient analysis to support complete eradication:

• Submit the sample to a sandbox for dynamic analysis (behavioral report, dropped files, network IOCs)
• Identify all persistence mechanisms: registry keys, scheduled tasks, services, WMI subscriptions, startup folders
• Document all file system artifacts: dropped files, modified files, created directories
• Extract network IOCs: C2 domains, IPs, URLs, user agents, JA3/JA3S hashes
• Map observed behaviors to MITRE ATT&CK techniques

Malware Analysis Summary - Qakbot Variant
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Initial Access:   T1566.001 - Spearphishing Attachment (.docm)
Execution:        T1059.001 - PowerShell (encoded downloader)
Persistence:      T1053.005 - Scheduled Task
Defense Evasion:  T1055.012 - Process Hollowing (explorer.exe)
C2:               T1071.001 - HTTPS with custom headers
Collection:       T1005 - Data from Local System (browser credentials)
Exfiltration:     T1041 - Exfiltration Over C2 Channel

Artifacts:
- C:\Users\*\AppData\Local\Temp\update.exe (dropper)
- C:\ProgramData\Microsoft\{GUID}\config.dll (payload)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\{random} (backup persistence)
- Scheduled Task: "WindowsUpdate" (primary persistence)

Step 5: Eradicate the Malware

Remove all malware artifacts from every infected system:

• Terminate malicious processes and injected threads
• Delete malware files from all identified paths
• Remove persistence mechanisms (scheduled tasks, registry keys, services, WMI subscriptions)
• Clear browser credential stores if credential harvesting was confirmed
• Run a full EDR scan to verify no artifacts remain
• If eradication confidence is low, reimage the system from a known-clean gold image

Step 6: Recover and Validate

Restore systems to production and verify clean status:

• Reconnect contained systems to the network in stages
• Monitor for 72 hours for any recurrence of malware indicators
• Force password resets for all users on infected endpoints
• Verify that C2 traffic has completely ceased across the environment
• Update detection rules based on newly discovered IOCs from the investiga