High severityHARDEC6 steps · 5 phases
Malware / Endpoint Compromise
Malicious software execution incident on an endpoint (NIST SP 800-83 + SANS FOR508).
Information note
Informational note: In malware incident response, persistence mechanisms should receive the highest priority; since malware must execute, execution evidence (Prefetch, ShimCache, Amcache) is always present. Prepare an automated triage script covering all MITRE ATT&CK persistence categories (T1547, T1543, T1546). WMI event subscription-based persistence is especially overlooked; always monitor unusual process hierarchies under
wmiprvse.exe in EDR telemetry.1
Preparation
1 steps- EDR + triage kit
Centralized EDR, memory/disk imaging tools, sandbox, IOC feed.
2
Detection & Analysis
1 steps- Classify the malware
Process tree, hash/IOC, C2, persistence mechanism, affected host list.
3
Containment, Eradication & Recovery
2 steps- Isolate the host
Disconnect from network (EDR contain), collect volatile evidence (RAM), scan other hosts.
- Clean up
Remove malicious files/services/tasks/registry entries, patch the vulnerability, reset affected credentials.
4