Conducting Malware Incident Response

When to Use

• EDR or antivirus detects malware execution on one or more endpoints
• A user reports suspicious system behavior indicative of malware infection
• Threat intelligence indicates a malware campaign targeting the organization's industry
• Network monitoring detects beaconing traffic consistent with known malware C2 patterns
• A file detonation in a sandbox returns a malicious verdict

Do not use for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.

Prerequisites

• EDR platform with process tree visibility and host isolation capability
• Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
• Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
• Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
• Clean system images or gold images for endpoint rebuild