conducting-malware-incident-response

Files (4)

• LICENSE
• SKILL.md
• api-reference.md · references/
• agent.py · scripts/

SKILL.md (first lines)

# Conducting Malware Incident Response

## When to Use

- EDR or antivirus detects malware execution on one or more endpoints
- A user reports suspicious system behavior indicative of malware infection
- Threat intelligence indicates a malware campaign targeting the organization's industry
- Network monitoring detects beaconing traffic consistent with known malware C2 patterns
- A file detonation in a sandbox returns a malicious verdict

**Do not use** for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.

## Prerequisites

- EDR platform with process tree visibility and host isolation capability
- Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)
- Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)
- Forensic imaging tools for evidence preservation (FTK Imager, KAPE)
- Clean system images or gold images for endpoint rebuild
- MITRE ATT&CK framework reference for technique mapping

## Workflow

### Step 1: Detect and Confirm Malware Presence

Validate the malware alert and gather initial indicators:

- Review EDR alert details: detection name, file path, hash (SHA-256), process tree
- Check if the detection is a known malware family or generic heuristic detection
- Query the file hash against VirusTotal, MalwareBazaar, and internal threat intelligence
- Examine the process execution chain to determine how the malware was delivered

```
Detection Summary:
File:        C:\Users\jsmith\AppData\Local\Temp\update.exe
SHA-256:     a1b2c3d4e5f6...
Detection:   CrowdStrike: Malware/Qakbot | VirusTotal: 58/72 engines
Parent:      WINWORD.EXE → cmd.exe → powershell.exe → update.exe
Delivery:    Email attachment (Invoice-Nov2025.docm)
Network:     HTTPS POST to 185.220.101[.]42:443 every 60s
Persistence: Scheduled Task "WindowsUpdate" → update.exe
```

### Step 2: Scope the Infection

Determine how many systems are affected and the malware's propagation method:

- Use EDR to search for the malware hash, filename, and behavioral indicators across all endpoints
- Check for network-based spreading (SMB, WMI, PsExec, exploitation)
- Query email gateway logs for all recipients of the delivery email
- Search for C2 communications to the identified infrastructure from other internal hosts
- Check for persistence mechanisms on all identified infected hosts

### Step 3: Contain Infected Systems

Execute containment per the active breach containment procedures:

- Network-isolate infected endpoints via EDR containment
- Block malware C2 infrastructure at firewall and DNS
- Block the malware hash in EDR prevention policy organization-wide
- Quarantine the delivery email from all mailboxes (if email-delivered)
- Disable compromised user accounts if credential theft is suspected

### Step 4: Analyze the Malware

Perform sufficient analysis to support complete eradication:

- Submit the sample to a sandbox for dynamic analysis (behavioral report, dropped files, network IOCs)
- Identify all persistence mechanisms: registry keys, scheduled tasks, services, WMI subscriptions, startup folders
- Document all file system artifacts: dropped files, modified files, created directories
- Extract network IOCs: C2 domains, IPs, URLs, user agents, JA3/JA3S hashes
- Map observed behaviors to MITRE ATT&CK techniques

```
Malware Analysis Summary - Qakbot Variant
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Initial Access:   T1566.001 - Spearphishing Attachment (.docm)
Execution:        T1059.001 - PowerShell (encoded downloader)
Persistence:      T1053.005 - Scheduled Task
Defense Evasion:  T1055.012 - Process Hollowing (explorer.exe)
C2:               T1071.001 - HTTPS with custom headers
Collection:       T1005 - Data from Local System (browser credentials)
Exfiltration:     T1041 - Exfiltration Over C2 Channel

Artifacts:
- C:\Users\*\AppData\Local\Temp\update.exe (dropper)
- C:\ProgramData\Microsoft\{GUID}\config.dll (payload)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\{random} (backup persistence)
- Scheduled Task: "WindowsUpdate" (primary persistence)
```

### Step 5: Eradicate the Malware

Remove all malware artifacts from every infected system:

- Terminate malicious processes and injected threads
- Delete malware files from all identified paths
- Remove persistence mechanisms (scheduled tasks, registry keys, services, WMI subscriptions)
- Clear browser credential stores if credential harvesting was confirmed
- Run a full EDR scan to verify no artifacts remain
- If eradication confidence is low, reimage the system from a known-clean gold image

### Step 6: Recover and Validate

Restore systems to production and verify clean status:

- Reconnect contained systems to the network in stages
- Monitor for 72 hours for any recurrence of malware indicators
- Force password resets for all users on infected endpoints
- Verify that C2 traffic has completely ceased across the environment
- Update detection rules based on newly discovered IOCs from the investigation
- Distribute IOCs to threat intelligence sharing partners (ISAC, MISP)

## Key Concepts

| Term | Definition |
|------|------------|
| **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.g., Qakbot, Emotet, Cobalt Strike) |
| **Process Hollowing** | Technique where malware creates a legitimate process in a suspended state, replaces its memory with malicious code, then resumes execution |

From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.

More from mukul975/Anthropic-Cybersecurity-Skills