ArcanaIncident-response documentationBrowse the feedTemplates
Back to feed
Playbook
PB-003

Endpoint Malware Infection

1. Purpose & Scope

  • Purpose:

    To describe the incident response steps for a malware compromise on corporate workstations, servers, or cloud hosts.

  • Scope:

    Applies to all endpoint malware incidents across the organisation, including:

    • Commodity malware infections
    • Initial access malware (loaders, droppers)
    • Remote access trojans (RATs)
    • Persistence-based compromise
    • Malware-assisted lateral movement

2. Incident Identification & Criteria

Incident Type: Endpoint Malware Infection

Trigger Conditions:

Initiate this playbook when any of the following occur:

  • EDR malware detection
  • Suspicious process execution observed
  • Known malicious file hash identified on a host
  • RAT / C2 beaconing detected
  • Persistence mechanism identified (run keys, scheduled tasks, services, launch agents, cron)
  • User reports suspicious endpoint behaviour
  • Malware sandbox detonation confirms malicious activity

Severity Levels:

SeverityDescription
Sev 3Isolated malware detection with no confirmed execution
Sev 2Confirmed malware execution on a single endpoint with no observed propagation
Sev 1Malware with credential theft, lateral movement capability, or impacting a business-critical system
Sev 0Widespread malware propagation or enterprise-wide compromise

3. Roles & Responsibilities

  • Incident Commander: Coordinates and leads the response to the malware incident; drives decisions and timelines; ensures containment, communications, and remediation actions are executed.
  • Communications Lead: Manages internal and external communications, executive updates, and stakeholder messaging.
  • Incident Responder/Forensic Analyst: Performs forensic analysis of impacted hosts, payload analysis, persistence hunts, identifies patient zero, and preserves evidence.
  • Other Roles:
    • Identity & Access Team: Supports credential reset, session revocation, and privileged account review where credential exposure is identified.
    • Network/Infrastructure Team: Executes host isolation, network segmentation, and supports lateral-movement containment.
    • Endpoint/Platform Team: Supports endpoint rebuild, re-imaging, and validation prior to return to service.

4. Initial Actions

  • Immediate Steps:

    • Perform EDR alert triage to validate the detection and assess immediate risk

      Decision Point:

      • If false positive → close with documentation
      • If true positive → continue
    • Isolate the impacted endpoint to prevent additional payload execution and lateral movement
    • Notify Incident Response leadership and assign roles
    • Preserve volatile evidence where feasible (avoid additional shutdowns or reboots unless required)

    Warning: Do NOT assume malware activity is isolated to a single endpoint until lateral movement, persistence mechanisms, and credential exposure have been assessed across adjacent systems. Malware infections frequently represent broader compromise activity.

5. Investigation & Analysis

  • Evidence Collection:

    • For all newly identified infected hosts:
      • collect the following host telemetry over the incident window:
        • Process execution - focus on suspicious parent-child chains, LOLBin usage, and unsigned/unknown binaries
        • File system events - payload drops, unsigned executables in user/temp directories, persistence file writes
        • Script & interpreter activity - encoded/obfuscated PowerShell, bash, zsh, python; LOLBins
        • Network connections - outbound beacons, unusual DNS lookups, connections to unknown destinations
        • Authentication / logon - lateral movement over RDP, SSH, SMB
        • Persistence - scheduled tasks, cron, services/daemons, launch agents, autoruns
        • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
      • capture a full memory snapshot to preserve volatile artefacts before any reboot, reimage, or shutdown

  • Analysis Steps:

    Decision Point: For each identified initial access vector, run the post-detection phases (Analysis → Recovery) of the relevant playbook concurrently alongside this one:

    • Analyse the malware payload to identify family, behaviour, capabilities (credential theft, lateral movement, exfiltration, encryption), and indicators of compromise

    Decision Point:

    • If ransomware behaviour identified → run the post-detection phases (Analysis → Recovery) of PB-002: Ransomware concurrently alongside this playbook.
    • If data exfiltration identified → run the post-detection phases (Analysis → Recovery) of PB-005: Data Exfiltration concurrently alongside this playbook.

6. Containment, Eradication & Recovery

Warning: Do NOT begin recovery activities until:

  • Containment is verified
  • Persistence mechanisms are identified and removed
  • Credential exposure has been assessed
  • Propagation paths are understood

Premature recovery may result in reinfection or repeated compromise.

  • Containment Actions:

    • Short-term (immediate) containment:
    • Long-term (identity) containment:

      Decision Point:

      • If privileged account compromise confirmed → immediate enterprise-wide escalation.

  • Eradication and Recovery Steps:

    • Rebuild impacted hosts from known-good images and validate before reconnection
    • Restore user access in a controlled manner
    • Monitor for reinfection and reintroduce systems gradually

      Decision Point:

      • If reinfection activity observed → halt recovery activities immediately and return to containment.

7. Communication & Escalation

8. Post-Incident Activities

  • Lessons Learned:

    • Schedule and conduct a Post-Incident Review (PIR)
    • Document what went well and what needs improvement
    • Review control failures (detection, segmentation, privileged access, endpoint hardening)
    • Identify and close detection gaps

  • Documentation Updates:

    • Update this playbook, linked runbooks, and KB articles to reflect lessons learned
    • Update detections and threat intelligence based on observed TTPs

9. References & Linked Resources

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.