PB-003: Endpoint Malware Infection

Document Control

1. Purpose & Scope

• Purpose:

  To describe the incident response steps for a malware compromise on corporate workstations, servers, or cloud hosts.

• Scope:

  Applies to all endpoint malware incidents across the organisation, including:

  • Commodity malware infections
  • Initial access malware (loaders, droppers)
  • Remote access trojans (RATs)
  • Persistence-based compromise
  • Malware-assisted lateral movement

2. Incident Identification & Criteria

Incident Type: Endpoint Malware Infection

Trigger Conditions:

Initiate this playbook when any of the following occur:

• EDR malware detection
• Suspicious process execution observed
• Known malicious file hash identified on a host
• RAT / C2 beaconing detected
• Persistence mechanism identified (run keys, scheduled tasks, services, launch agents, cron)
• User reports suspicious endpoint behaviour
• Malware sandbox detonation confirms malicious activity

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Coordinates and leads the response to the malware incident; drives decisions and timelines; ensures containment, communications, and remediation actions are executed.
• Communications Lead: Manages internal and external communications, executive updates, and stakeholder messaging.
• Incident Responder/Forensic Analyst: Performs forensic analysis of impacted hosts, payload analysis, persistence hunts, identifies patient zero, and preserves evidence.
• Other Roles:
  • Identity & Access Team: Supports credential reset, session revocation, and privileged account review where credential exposure is identified.
  • Network/Infrastructure Team: Executes host isolation, network segmentation, and supports lateral-movement containment.
  • Endpoint/Platform Team: Supports endpoint rebuild, re-imaging, and validation prior to return to service.

4. Initial Actions

• Immediate Steps:

  • Perform EDR alert triage to validate the detection and assess immediate risk
    • 📘 RB-TRIAGE-002: EDR Alert Triage

    Decision Point:

    • If false positive → close with documentation
    • If true positive → continue

  • Isolate the impacted endpoint to prevent additional payload execution and lateral movement
    • 📘 RB-CONTAIN-004: Host Isolation
  • Notify Incident Response leadership and assign roles
  • Preserve volatile evidence where feasible (avoid additional shutdowns or reboots unless required)
    • 📘 RB-EVIDENCE-001: Memory Acquisition

  Warning: Do NOT assume malware activity is isolated to a single endpoint until lateral movement, persistence mechanisms, and credential exposure have been assessed across adjacent systems. Malware infections frequently represent broader compromise activity.

5. Investigation & Analysis

• Evidence Collection:

  • For all newly identified infected hosts:
    • collect the following host telemetry over the incident window:
      • Process execution - focus on suspicious parent-child chains, LOLBin usage, and unsigned/unknown binaries
      • File system events - payload drops, unsigned executables in user/temp directories, persistence file writes
      • Script & interpreter activity - encoded/obfuscated PowerShell, bash, zsh, python; LOLBins
      • Network connections - outbound beacons, unusual DNS lookups, connections to unknown destinations
      • Authentication / logon - lateral movement over RDP, SSH, SMB
      • Persistence - scheduled tasks, cron, services/daemons, launch agents, autoruns
      • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
    • capture a full memory snapshot to preserve volatile artefacts before any reboot, reimage, or shutdown
      • 📘 RB-EVIDENCE-001: Memory Acquisition

• Analysis Steps:

  • Reconstruct the process tree to identify the execution source, parent process, and command-line arguments
    • 📘 RB-ANALYSIS-006: Process Tree Analysis

  Decision Point: For each identified initial access vector, run the post-detection phases (Analysis → Recovery) of the relevant playbook concurrently alongside this one:

  • Phishing → PB-001: Phishing & Credential Theft
  • Account takeover → PB-004: Account Takeover
  • Zero-day exploitation → PB-018: Zero-Day Response
  • Known/patched vulnerability exploited → PB-017: Vulnerability Response

  • Analyse the malware payload to identify family, behaviour, capabilities (credential theft, lateral movement, exfiltration, encryption), and indicators of compromise
    • 📘 RB-ANALYSIS-015: Malware Analysis

  Decision Point:

  • If ransomware behaviour identified → run the post-detection phases (Analysis → Recovery) of PB-002: Ransomware concurrently alongside this playbook.
  • If data exfiltration identified → run the post-detection phases (Analysis → Recovery) of PB-005: Data Exfiltration concurrently alongside this playbook.

  • Perform memory analysis to identify injected processes, in-memory persistence, and active malware artefacts
    • 📘 RB-ANALYSIS-016: Memory Analysis
  • Hunt for persistence mechanisms across the host (scheduled tasks, services, registry run keys, launch agents/daemons, cron jobs)
    • 📘 RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
  • Document findings, attack timeline, and indicators of compromise (IOCs)

6. Containment, Eradication & Recovery

Warning: Do NOT begin recovery activities until:

• Containment is verified
• Persistence mechanisms are identified and removed
• Credential exposure has been assessed
• Propagation paths are understood

Premature recovery may result in reinfection or repeated compromise.

• Containment Actions:

  • Short-term (immediate) containment:
    • Isolate impacted hosts to prevent additional payload execution and lateral movement
      • 📘 RB-CONTAIN-004: Host Isolation
  • Long-term (identity) containment:
    • Where credential exposure is identified, revoke active sessions and reset credentials for affected accounts
      • 📘 RB-CONTAIN-005: Session Token Revocation

    Decision Point:

    • If privileged account compromise confirmed → immediate enterprise-wide escalation.

• Eradication and Recovery Steps:

  • Rebuild impacted hosts from known-good images and validate before reconnection
    • 📘 RB-RECOVERY-002: Clean System Rebuild - for per-host rebuild, hardening, and validation
  • Restore user access in a controlled manner
    • 📘 RB-RECOVERY-003: User Recovery & Access Restoration
  • Monitor for reinfection and reintroduce systems gradually

    Decision Point:

    • If reinfection activity observed → halt recovery activities immediately and return to containment.

7. Communication & Escalation

• Internal Communication:

  • Notify affected users and business units

    • 📘 SOP-004: User Notification

  • Provide regular incident updates to leadership and impacted teams

  • Issue org-wide advisory if propagation is broad or critical services are impacted

• External Communication:

  • Engage Legal/Privacy to assess regulatory and breach notification obligations where credential or data exposure is suspected
  • Notify customers, regulators, and partners as directed by Legal
  • Coordinate all external messaging with Communications Lead and Legal
    • 📘 SOP-003: Escalation, Legal & Executive Communications

• Escalation Criteria:

  Condition	Escalate To
  Phishing identified as initial access vector	PB-001: Phishing & Credential Theft
  Account takeover identified as initial access vector	PB-004: Account Takeover
  Zero-day vulnerability exploited as initial access vector	PB-018: Zero-Day Response
  Known/patched vulnerability exploited as initial access vector	PB-017: Vulnerability Response
  Ransomware behaviour identified	PB-002: Ransomware
  Data exfiltration confirmed	PB-005: Data Exfiltration
  Enterprise-wide propagation or critical infrastructure impact	PB-019: Major Security Incident Management / Executive escalation

8. Post-Incident Activities

• Lessons Learned:

  • Schedule and conduct a Post-Incident Review (PIR)
  • Document what went well and what needs improvement
  • Review control failures (detection, segmentation, privileged access, endpoint hardening)
  • Identify and close detection gaps

• Documentation Updates:

  • Update this playbook, linked runbooks, and KB articles to reflect lessons learned
  • Update detections and threat intelligence based on observed TTPs

9. References & Linked Resources

• Playbooks:

  • PB-001: Phishing & Credential Theft
  • PB-002: Ransomware
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-017: Vulnerability Response
  • PB-018: Zero-Day Response
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-002: EDR Alert Triage
  • RB-CONTAIN-004: Host Isolation
  • RB-CONTAIN-005: Session Token Revocation
  • RB-ANALYSIS-006: Process Tree Analysis
  • RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
  • RB-ANALYSIS-015: Malware Analysis
  • RB-ANALYSIS-016: Memory Analysis
  • RB-EVIDENCE-001: Memory Acquisition
  • RB-EVIDENCE-002: Host-Based Log Acquisition
  • RB-RECOVERY-002: Clean System Rebuild
  • RB-RECOVERY-003: User Recovery & Access Restoration

• SOPs:

  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-004: User Notification

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.