PB-011: Suspicious Execution

Document Control

1. Purpose & Scope

• Purpose:

  This playbook defines the response workflow for suspicious process, command-line, script, binary, or interpreter execution. It helps responders validate whether activity is authorised, malicious, or part of a broader incident such as malware, privilege escalation, lateral movement, account takeover, cloud compromise, or data exfiltration.

• Scope:

  Applies to suspicious execution on endpoints, servers, cloud workloads, containers, virtual machines, administrative hosts, and user workstations. Includes LOLBin abuse, encoded or obfuscated commands, script execution, suspicious parent-child processes, unknown binaries, EDR behavioural detections, and unauthorised administrative tooling.

2. Incident Identification & Criteria

Incident Type: Suspicious Execution

Trigger Conditions:

Initiate this playbook when any of the following occur:

• Suspicious process execution or EDR behavioural alert
• Encoded, obfuscated, or high-risk command-line activity
• PowerShell, bash, Python, JavaScript, VBScript, HTA, or batch execution from unusual context
• LOLBin abuse such as suspicious PowerShell, rundll32, regsvr32, mshta, wmic, certutil, bitsadmin, schtasks, cscript, or wscript activity
• Office, browser, email client, archive utility, or PDF reader spawning a shell, interpreter, or downloader
• Unknown, unsigned, or newly dropped binary execution
• Execution from temporary directories, user profile paths, network shares, removable media, or cloud sync folders
• Process behaviour indicating persistence, credential theft, lateral movement, discovery, staging, or exfiltration

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Coordinates response, sets severity, approves containment, and manages escalation.
• Incident Responder / Forensic Analyst: Validates execution activity, analyses command lines and process trees, scopes affected assets, and preserves evidence.
• Communications Lead: Coordinates internal updates and affected-user communications.
• Other Roles:
  • Endpoint / Platform Team: Supports host isolation, log collection, rebuild, and endpoint control validation.
  • Identity & Access Team: Supports account containment if execution indicates credential or token theft.
  • Network Team: Supports outbound blocking or segmentation when C2, download, exfiltration, or lateral movement is identified.
  • Cloud Security / Platform Team: Supports cloud workload evidence collection and isolation when suspicious execution occurs in cloud-hosted infrastructure.
  • Application / Service Owners: Validate business purpose and support recovery where execution occurred in production systems.

4. Initial Actions

• Immediate Steps:

  • Triage the alert, affected host, user context, process, parent process, command line, file hash, and detection source.
    • 📘 RB-TRIAGE-002: EDR Alert Triage
  • Determine whether the process is still running, whether child processes exist, and whether network activity is active.

  Decision Point:

  • If execution is approved and expected → document rationale and close.
  • If malicious, unauthorised, or unresolved → continue investigation and contain if active risk exists.

  Warning: Do not assume execution is benign because the binary is signed, the command completed successfully, the user appears to have initiated it, or antivirus did not alert.

5. Investigation & Analysis

• Evidence Collection:

  • Collect process execution, command line, parent-child process, file, registry, persistence, network, DNS, authentication, and EDR telemetry for the affected host and time window.
    • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
    • 📘 RB-EVIDENCE-001: Memory Acquisition
    • If execution occurred on a cloud workload, preserve cloud control plane and workload evidence.
      • 📘 RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
      • 📘 RB-EVIDENCE-005: Cloud Workload Snapshot Acquisition
  • Preserve suspicious scripts, binaries, payloads, command output, decoded content, hashes, and sandbox results where available.

• Analysis Steps:

  • Reconstruct process ancestry, child processes, execution source, and user context.
    • 📘 RB-ANALYSIS-006: Process Tree Analysis
  • Analyse full command lines, arguments, hidden flags, download activity, encoded content, and adversary techniques.
    • 📘 RB-ANALYSIS-023: Command-Line Analysis
  • Investigate LOLBin usage and determine whether legitimate tools were abused for execution, persistence, credential access, discovery, lateral movement, staging, exfiltration, or evasion.
    • 📘 RB-ANALYSIS-024: LOLBin Abuse Investigation
  • Analyse script type, origin, contents, obfuscation, network activity, and execution intent.
    • 📘 RB-ANALYSIS-025: Script Execution Analysis
  • Validate whether execution was authorised by the user, manager, system owner, IT operations, development team, change record, or scheduled maintenance.
    • 📘 RB-ANALYSIS-026: User Activity Validation
  • Review persistence mechanisms if execution created services, scheduled tasks, startup entries, registry changes, cron jobs, launch agents, WMI subscriptions, or cloud scheduled execution.
    • 📘 RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
  • Analyse malware behaviour where payloads, C2, credential theft, persistence, or secondary execution are identified.
    • 📘 RB-ANALYSIS-015: Malware Analysis
  • Analyse memory where process injection, in-memory execution, hidden processes, credential material, or memory-only malware is suspected.
    • 📘 RB-ANALYSIS-016: Memory Analysis
  • Review outbound traffic if execution involved downloads, C2, reverse shells, cloud storage, or external transfers.
    • 📘 RB-ANALYSIS-018: Outbound Traffic Analysis
  • Hunt for the same hashes, command lines, scripts, tools, parent processes, users, or infrastructure across the environment.
    • 📘 RB-ANALYSIS-035: Affected Asset Identification

  Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:

  • Malware confirmed → execute PB-003: Endpoint Malware Infection concurrently.
  • Privilege escalation identified → execute PB-009: Privilege Escalation concurrently.
  • Lateral movement identified → execute PB-010: Lateral Movement concurrently.
  • Credential or account compromise identified → execute PB-004: Account Takeover concurrently.
  • Data staging or exfiltration identified → execute PB-005: Data Exfiltration concurrently.
  • Cloud workload or control plane abuse identified → execute PB-007: Cloud Compromise concurrently.

6. Containment, Eradication & Recovery

• Containment Actions:

  • Isolate affected hosts when execution is malicious, still active, or associated with credential theft, persistence, C2, or lateral movement.
    • 📘 RB-CONTAIN-004: Host Isolation
  • Isolate affected cloud workloads when suspicious execution occurs in cloud infrastructure.
    • 📘 RB-CONTAIN-015: Cloud Workload Isolation
  • Lock or reset accounts and revoke sessions where credential theft, token theft, or account misuse is suspected.
    • 📘 RB-CONTAIN-001: Account Lockdown
    • 📘 RB-CONTAIN-005: Session & Token Revocation
  • Block active outbound attacker infrastructure or transfer paths.
    • 📘 RB-CONTAIN-007: Outbound Transfer Blocking
  • Restrict lateral movement paths if remote execution or propagation is suspected.
    • 📘 RB-CONTAIN-002: Rapid Containment & Network Segmentation

• Eradication Steps:

  • Remove malicious binaries, scripts, payloads, scheduled tasks, services, registry entries, cron jobs, launch agents, WMI subscriptions, attacker-created accounts, and unauthorised tooling.
  • Remove or roll back unauthorised configuration changes and persistence mechanisms.
  • Rotate credentials, secrets, tokens, certificates, and keys that may have been exposed during execution.

• Recovery Steps:

  • Rebuild or re-provision systems where integrity cannot be validated.
    • 📘 RB-RECOVERY-002: Clean System Rebuild
  • Coordinate phased restoration when multiple hosts, users, or dependencies are affected.
    • 📘 RB-RECOVERY-001: Recovery & Restoration Coordination
  • Restore user access only after credentials, sessions, tokens, MFA, and endpoint integrity are validated.
    • 📘 RB-RECOVERY-003: User Recovery & Access Restoration
  • Monitor for recurrence using hashes, command lines, decoded content, parent-child chains, network destinations, scripts, and observed TTPs.

7. Communication & Escalation

• Internal Communication:

  • Notify security leadership, endpoint/platform owners, identity teams, service owners, and affected business teams when containment or downtime is required.
  • Use geo handoff where the incident spans shifts.
    • 📘 SOP-002: Incident Handoff Between Geos
  • Notify affected users if account reset, MFA reset, device rebuild, or access restoration is required.
    • 📘 SOP-004: User Notification

• External Communication:

  • Engage Legal/Privacy if suspicious execution resulted in customer data access, regulated data exposure, public service impact, or third-party impact.
    • 📘 SOP-003: Escalation, Legal & Executive Communications

• Escalation Criteria:

  Condition	Escalate To
  Malware, payload, C2, or persistence confirmed	PB-003: Endpoint Malware Infection
  Credential theft or account compromise identified	PB-004: Account Takeover
  Privilege escalation identified	PB-009: Privilege Escalation
  Lateral movement or remote execution identified	PB-010: Lateral Movement
  Data staging or exfiltration identified	PB-005: Data Exfiltration
  Cloud workload or control plane abuse identified	PB-007: Cloud Compromise
  Widespread execution, ransomware behaviour, or critical infrastructure impact	PB-019: Major Security Incident Management

8. Post-Incident Activities

• Lessons Learned:

  • Conduct a Post-Incident Review (PIR)
  • Document what worked, what didn't, and what needs improvement

• Documentation Updates:

  • Update this playbook, linked runbooks, detection content, allowlists, administrative tooling guidance, and endpoint hardening guidance where required.

9. References & Linked Resources

• Playbooks:

  • PB-003: Endpoint Malware Infection
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-009: Privilege Escalation
  • PB-010: Lateral Movement
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-002: EDR Alert Triage
  • RB-EVIDENCE-001: Memory Acquisition
  • RB-EVIDENCE-002: Host-Based Log Acquisition
  • RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
  • RB-EVIDENCE-005: Cloud Workload Snapshot Acquisition
  • RB-ANALYSIS-006: Process Tree Analysis
  • RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
  • RB-ANALYSIS-015: Malware Analysis
  • RB-ANALYSIS-016: Memory Analysis
  • RB-ANALYSIS-018: Outbound Traffic Analysis
  • RB-ANALYSIS-023: Command-Line Analysis
  • RB-ANALYSIS-024: LOLBin Abuse Investigation
  • RB-ANALYSIS-025: Script Execution Analysis
  • RB-ANALYSIS-026: User Activity Validation
  • RB-ANALYSIS-035: Affected Asset Identification
  • RB-CONTAIN-001: Account Lockdown
  • RB-CONTAIN-002: Rapid Containment & Network Segmentation
  • RB-CONTAIN-004: Host Isolation
  • RB-CONTAIN-005: Session & Token Revocation
  • RB-CONTAIN-007: Outbound Transfer Blocking
  • RB-CONTAIN-015: Cloud Workload Isolation
  • RB-RECOVERY-001: Recovery & Restoration Coordination
  • RB-RECOVERY-002: Clean System Rebuild
  • RB-RECOVERY-003: User Recovery & Access Restoration
  • RB-POST-001: Ransomware Post-Incident Hardening

• SOPs:

  • SOP-002: Incident Handoff Between Geos
  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-004: User Notification

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.