Malware Playbook - Manual Deprecated Hidden

Deprecated. Use "Malware Investigation - Manual" playbook instead. Master playbook for investigating suspected malware presence on an endpoint. Labels: - System: the hostname for the endpoint being investigated

Deprecated Content (Deprecated) · 89 tasks · 0 inputs · 0 outputs

Flowchart

yes yes yes yes yes yes no yes no yes no yes start_task start_task Initial Triage Initial Triage Retrieve device profile from IT asset management software Retrieve device profile f... Retrieve employee information of the machine's owner from HR software Retrieve employee informa... Review incident details Review incident details Assess severity Assess severity Notify head of IR team via Slack and Email Notify head of IR team vi... Assign and involve appropriate personnel Assign and involve approp... Review monitoring data Review monitoring data Is Carbon Black available? - Exists Is Carbon Black available? Exists Query Carbon Black for events around the time of the incident Query Carbon Black for ev... Is ProtectWise available? - Exists Is ProtectWise available? Exists Retrieve observations related to the investigated machine Retrieve observations rel... Retrieve events related to the investigated machine Retrieve events related t... Is Splunk available? - Exists Is Splunk available? Exists Search Splunk for recent events related to the investigated machine Search Splunk for recent ... Do we have a continuous network capture of the investigated machine? Do we have a continuous n... Retrieve packet capture for last 24 hours or at most 200MB Retrieve packet capture f... Review antivirus logs for the affected systems Review antivirus logs for... Search UEBA solution for the relevant user's behavior in past 24 hours Search UEBA solution for ... Search DNS server logs for investigated machine's activity Search DNS server logs fo... Search web proxy logs for recent activity from this machine Search web proxy logs for... Search firewall logs for blocked traffic from this machine Search firewall logs for ... Collect evidence from the investigated machine Collect evidence from the... Is Tanium available? Is Tanium available? Collect system information using Tanium Collect system informatio... Trigger a snapshot / sytem restore point of affected systems Trigger a snapshot / syte... Collect volatile system data Collect volatile system data Fetch the system's security event log Fetch the system's securi... Create memory dump of the system Create memory dump of the... Collect autorun data - Autoruns Collect autorun data Autoruns Collect prefetch data Collect prefetch data Collect browser history Collect browser history Collect USB device history Collect USB device history Analyze collected evidence Analyze collected evidence Look for suspicious local Windows user accounts and groups Look for suspicious local... Look for suspicious autorun entries Look for suspicious autor... Review file reputation for all autorun items Review file reputation fo... Detonate any suspicious autorun items in sandbox Detonate any suspicious a... Check processes against our arsenal of YARA signatures Check processes against o... Volatility - search for malicious IP addresses in network connection artifacts Volatility - search for m... Volatility - Check domains in DNS cache against threat intelligence Volatility - Check domain... Volatility - Search for suspicious domains in DNS cache artifacts Volatility - Search for s... Volatility - review psxview results Volatility - review psxvi... Volatility - review malfind results Volatility - review malfi... Volatility - show list of previously run system commands Volatility - show list of... Correlate recently created and modified files against threat intelligence Correlate recently create... Review prefetch data Review prefetch data Review history of connected USB drives Review history of connect... Look for processes without executable image on disk Look for processes withou... Look for system processes with suspicious execution times Look for system processes... Look for process names with short edit distance from known process names Look for process names wi... Check process tree and look for suspicious relations Check process tree and lo... Look for traces of network sniffers Look for traces of networ... Analyze network traffic for malware activity Analyze network traffic f... Review shellbag data Review shellbag data Look up hashes of all running processes and loaded modules to find trojanized modules Look up hashes of all run... Analyze network traffic for signs of intrusion Analyze network traffic f... Look for modifications of system files Look for modifications of... Data Leak Assessment Data Leak Assessment Assess history of C&C communication in network logs Assess history of C&C com... Assess history of local and remote file accesses by the malware Assess history of local a... Assess unusual activity and data access by compromised user accounts Assess unusual activity a... Was any sensitive information leaked? Was any sensitive informa... Notify Public Relations (PR) team Notify Public Relations (... Respond Respond Was malware found? Was malware found? Inform user that no malware was found Inform user that no malwa... Report malware sample to AV vendor Report malware sample to ... Disable compromised AD account(s) Disable compromised AD ac... Revoke authentication keys stored on the compromised host Revoke authentication key... Revoke VPN credentials Revoke VPN credentials Instruct owner to change passwords for any personal accounts Instruct owner to change ... Ban relevant hashes across all systems Ban relevant hashes acros... Search for same malicious communications from other systems Search for same malicious... Remediate and wrap up Remediate and wrap up Notify affected user Notify affected user Provide end-user remediation guidance and link to training Provide end-user remediat... Is the identified malware known? (with automated remediation steps) Is the identified malware... Document manual remediation steps Document manual remediati... Trigger remediation scripts Trigger remediation scripts Was remediation successful? Was remediation successful? Open a ticket for IT to reimage the entire system and restore from backup Open a ticket for IT to r... Remove temporary containment measures Remove temporary containm... Reinstate disabled user accounts with new passwords Reinstate disabled user a... Deploy generated IoCs in relevant controls to prevent future attacks Deploy generated IoCs in ... Share generated IoCs with partner organizations Share generated IoCs with... Email report to CISO Email report to CISO Expose Configured Integrations - ExposeModules Expose Configured Integra... ExposeModules