CySA+ Runbook 04 — Malware and Endpoint Compromise Investigation

Runbook Information

Item	Details
Runbook	04
Runbook Name	Malware and Endpoint Compromise Investigation
Track	CompTIA CySA+
Difficulty	Intermediate–Advanced
Primary Role	SOC Analyst / Cybersecurity Analyst
Purpose	Investigate malware detections and determine whether an endpoint has been compromised
Primary Systems	EDR/XDR, SIEM, Windows/Linux Endpoints, DNS, Firewall, IDS/IPS, Threat Intelligence
Primary Data Sources	EDR Telemetry, Process Logs, Windows Event Logs, PowerShell Logs, File Metadata, Registry, Services, DNS, Network Telemetry
Output	Benign / Malware Blocked / Suspected Compromise / Confirmed Endpoint Compromise / Escalation
Related Labs	Lab 03, Lab 12, Lab 13, Lab 16, Lab 17, Lab 18, Lab 20

Operational Principle: A malware alert does not automatically mean an endpoint is compromised. Determine whether the malicious artifact actually executed, what it did, what persistence or network activity followed, and whether the activity spread beyond the original system.

1. Purpose

This runbook provides a repeatable SOC procedure for investigating malware and suspicious endpoint activity.

The investigation should answer:

What triggered the alert?
      ↓
What file or process was involved?
      ↓
Did execution occur?
      ↓
What launched it?
      ↓
What did it launch?
      ↓
Was persistence established?
      ↓
Did credentials or privileges become involved?
      ↓
Did the endpoint communicate externally?
      ↓
Did the activity spread internally?
      ↓
What is the scope?
      ↓
Is the endpoint compromised?
      ↓
What must be contained?

2. When to Use This Runbook

Use this runbook for:

antivirus or EDR malware alerts
suspicious executable detections
malicious file-hash alerts
suspicious PowerShell activity
unusual process execution
suspicious parent-child process relationships
script execution
ransomware indicators
unexpected persistence
malicious scheduled tasks
suspicious services
unusual registry modifications
command-and-control indicators
endpoint behavior associated with phishing
suspected post-exploitation activity

3. Expected Outcomes

Every investigation should reach a defensible disposition:

Endpoint Alert
      ↓
Investigation
      ↓
├── False Positive
│
├── Benign True Positive
│
├── Malicious Artifact Blocked
│
├── Suspicious — Further Investigation
│
├── Confirmed Endpoint Compromise
│
└── Inconclusive — Escalate / Monitor

4. Endpoint Investigation Workflow

Use:

Alert Received
      ↓
Preserve Alert
      ↓
Identify Endpoint
      ↓
Identify User
      ↓
Identify File / Process
      ↓
Determine Execution
      ↓
Build Process Tree
      ↓
Analyze Command Line
      ↓
Investigate Files
      ↓
Analyze Persistence
      ↓
Review Privilege Activity
      ↓
Analyze DNS / Network
      ↓
Enrich IOCs
      ↓
Hunt Across Environment
      ↓
Determine Scope
      ↓
Assess Compromise
      ↓
Contain
      ↓
Escalate
      ↓
Document

5. Step 1 — Record the Original Alert

Capture:

Case ID:

Alert ID:

Alert Name:

Detection Source:

Detection Time:

Hostname:

IP Address:

Username:

Process:

Parent Process:

Filename:

File Path:

SHA-256:

Command Line:

Detection Name:

Detection Severity:

EDR Action:

Preserve the original alert before taking remediation actions.

6. Step 2 — Determine the Detection Action

Identify whether the security control:

Detected

Blocked

Terminated

Quarantined

Deleted

Allowed

Failed to Remediate

Unknown

This distinction is critical.

For example:

Malicious File
      ↓
Blocked Before Execution

is very different from:

Malicious File
      ↓
Executed
      ↓
Created Persistence
      ↓
Established Network Connection

7. Step 3 — Identify the Endpoint

Record:

Hostname:

IP Address:

Operating System:

Endpoint Type:

Business Owner:

User:

Department:

Environment:

Asset Criticality:

EDR Status:

Classify criticality:

Low

Medium

High

Critical

8. Step 4 — Identify the User Context

Determine:

Username:

Account Type:

Privilege:

Login Time:

Interactive Session:

Normal Workstation:

Expected Activity:

Ask:

Was the user logged in?

Did the process execute as the user?

Did it execute as SYSTEM/root?

Was an administrator involved?

9. Step 5 — Establish the Investigation Window

Start with a reasonable period before and after the alert.

Example:

Detection:
14:35

Initial Investigation Window:
13:35–15:35

Expand backward until you identify the earliest suspicious activity.

Expand forward until activity ends or is contained.

10. Step 6 — Identify the Suspicious Artifact

Record:

Filename:

Full Path:

Extension:

Actual File Type:

Size:

Creation Time:

Modification Time:

Execution Time:

Owner:

Source:

Potential sources include:

Email Attachment

Browser Download

Network Share

USB

Script

Remote Session

Software Package

Unknown

11. Step 7 — Verify the Actual File Type

Do not trust the filename extension.

For a safely preserved artifact:

file suspicious-file

Compare:

Displayed Extension
        ↓
Actual File Type

Example:

invoice.pdf

could potentially be something entirely different if extension or file metadata is manipulated.

12. Step 8 — Calculate File Hashes

Calculate SHA-256:

sha256sum suspicious-file

Record:

SHA-256:

MD5:

SHA-1:

Prefer SHA-256 for IOC tracking.

13. Step 9 — Preserve the Artifact

If organizational procedures allow, preserve suspicious artifacts in an isolated evidence location.

Document:

Evidence ID:

Original Path:

Evidence Path:

Collection Time:

Collected By:

SHA-256:

Do not execute the artifact.

14. Step 10 — Perform Threat-Intelligence Enrichment

Using approved intelligence sources, investigate:

SHA-256

Filename

Associated Domain

Associated IP

Record:

Known / Unknown:

Classification:

Malware Family:

First Seen:

Last Seen:

Associated Campaign:

Related Infrastructure:

Confidence:

Remember:

Unknown Hash
≠
Benign

and:

Known Malicious Hash
≠
Proof of Successful Execution

15. Step 11 — Determine Whether Execution Occurred

This is one of the most important questions.

Search:

EDR Process Telemetry

Windows Event 4688

Sysmon Event 1

Linux Process Telemetry

Application Logs

Determine:

Execution:
Confirmed / Attempted / Blocked / Not Observed / Unknown

16. Step 12 — Identify the Executing Process

Record:

Process Name:

PID:

Path:

User:

Integrity / Privilege:

Start Time:

End Time:

Command Line:

17. Step 13 — Identify the Parent Process

Determine what launched the suspicious process.

Example:

OUTLOOK.EXE
     ↓
WINWORD.EXE
     ↓
powershell.exe

or:

chrome.exe
    ↓
downloaded.exe

or:

services.exe
     ↓
unknown.exe

Parent-child relationships provide critical context.

18. Step 14 — Build the Complete Process Tree

Construct:

Grandparent
     ↓
Parent
     ↓
Suspicious Process
     ↓
Child Process
     ↓
Additional Children

Record:

Time	Process	PID	Parent	User	Assessment
`<time>`	`<process>`	`<PID>`	`<parent>`	`<user>`	`<assessment>`

19. Step 15 — Identify Suspicious Process Relationships

Pay particular attention to unusual relationships such as:

Office Application
       ↓
PowerShell

Browser
   ↓
Command Shell

Web Server
    ↓
Shell

PDF Reader
    ↓
Script Interpreter

Unknown Executable
       ↓
Credential Tool

Context is required before declaring them malicious.

20. Step 16 — Analyze the Command Line

Record the complete command line where available.

Look for:

Encoded Content

Obfuscation

Unexpected URLs

Temporary Directories

Script Execution

Security-Control Changes

Discovery Commands

Credential Access Indicators

Remote Execution

Unusual Parameters

Do not execute suspicious commands discovered during analysis.

21. Step 17 — Investigate PowerShell

For Windows environments, review available:

PowerShell Operational Logs

Script Block Logging

Event ID 4104

Process Telemetry

Look for:

Encoded Commands

Download Activity

Obfuscation

Execution Policy Changes

Discovery

Credential-Related Activity

Defender Changes

Remote Connections

22. Step 18 — Decode Suspicious Content Safely

If encoded content exists, decode it using an approved offline analysis environment.

For example, Base64 data can be decoded without executing the resulting command.

Your objective is:

Decode
  ↓
Read
  ↓
Understand

not:

Decode
  ↓
Execute

23. Step 19 — Investigate Command Shell Activity

Review:

cmd.exe

powershell.exe

pwsh

bash

sh

zsh

Determine:

Who launched it?

From which process?

What commands were executed?

What happened afterward?

24. Step 20 — Identify File Creation Activity

Look for files created around the suspicious execution.

Record:

Filename

Path

Creating Process

Timestamp

Hash

User

Pay particular attention to:

Temporary Directories

User Profile Directories

Startup Locations

Public Directories

Web Directories

System Directories

25. Step 21 — Identify File Modification

Look for suspicious changes to:

Executables

Configuration Files

Scripts

Startup Files

Application Files

Security Configuration

Determine which process performed the modification.

26. Step 22 — Investigate Temporary Directories

Review suspicious activity involving locations such as:

%TEMP%

%APPDATA%

%LOCALAPPDATA%

/tmp

/var/tmp

These directories are commonly used by legitimate applications as well, so context is essential.

27. Step 23 — Investigate Persistence

Check for:

Scheduled Tasks

Services

Registry Run Keys

Startup Folders

New Accounts

Cron Jobs

Systemd Services

Login Scripts

Application Autostart

Classify:

Persistence:
Confirmed / Attempted / Not Observed / Unknown

28. Step 24 — Investigate Scheduled Tasks

For suspicious tasks, record:

Task Name:

Creation Time:

Creator:

Trigger:

Action:

Executable:

User Context:

Determine whether the task points to the suspicious artifact.

29. Step 25 — Investigate Services

Look for:

New Service

Modified Service

Unusual Binary Path

Executable in User-Writable Directory

Unexpected Service Account

Record:

Service Name:

Binary:

Account:

Start Type:

Creation Time:

30. Step 26 — Investigate Registry Persistence

For Windows endpoints, review relevant autorun locations.

Look for unexpected changes associated with:

Run

RunOnce

Services

Winlogon

Startup-related configuration

Record the exact key, value, process, and timestamp.

31. Step 27 — Investigate Startup Folders

Determine whether suspicious artifacts were placed in startup locations.

Record:

Filename:

Path:

Creator:

Timestamp:

Hash:

32. Step 28 — Investigate Linux Persistence

For Linux systems, consider:

cron

systemd

Shell Profiles

SSH Authorized Keys

Startup Scripts

New Users

Document findings without executing suspicious content.

33. Step 29 — Investigate Account Creation

For Windows environments, review relevant:

Event ID 4720

Determine:

Account Created:

Created By:

Timestamp:

Host:

Privileges:

Unexpected accounts may represent persistence.

34. Step 30 — Investigate Group Membership Changes

Review privileged group modifications where relevant.

Examples:

Administrators

Domain Admins

Remote Desktop Users

Determine whether suspicious identities gained additional access.

35. Step 31 — Investigate Privilege Activity

Determine whether the suspicious process executed as:

Standard User

Administrator

SYSTEM

root

Service Account

For Windows, correlate with relevant privileged-logon events such as:

where available.

36. Step 32 — Distinguish Privilege Escalation

Ask:

Did the attacker gain additional privilege?

versus:

Was an already-privileged account compromised?

Do not treat them as equivalent.

37. Step 33 — Investigate Security-Control Tampering

Look for attempts to:

Disable Antivirus

Stop EDR

Modify Firewall

Disable Logging

Delete Logs

Change Security Policies

Add Exclusions

Security-control tampering increases incident severity.

38. Step 34 — Investigate Log Clearing

For Windows, relevant evidence may include:

Event ID 1102

Determine:

Who cleared the log?

When?

Which system?

What activity occurred immediately before?

39. Step 35 — Investigate DNS Activity

Search DNS telemetry for the affected endpoint around the execution time.

Record:

Timestamp

Source Host

Queried Domain

Response

Process

where process-level attribution is available.

40. Step 36 — Identify Suspicious Domains

Look for:

Rare Domains

Newly Observed Domains

Unexpected Dynamic DNS

Unusual Subdomains

Domains Associated with Malware

Domains Queried Immediately After Execution

Do not classify domains solely based on rarity.

41. Step 37 — Investigate Network Connections

Review:

Source IP

Destination IP

Destination Port

Protocol

Timestamp

Process

Bytes Sent

Bytes Received

Correlate connections with suspicious processes.

42. Step 38 — Build the Process-to-Network Relationship

Example:

suspicious.exe
      ↓
DNS Query
      ↓
malicious-domain.example
      ↓
External IP
      ↓
TCP Connection

This is stronger evidence than a network connection without process context.

43. Step 39 — Review Zeek Telemetry

Where available, review:

conn.log

dns.log

http.log

ssl.log / tls.log

Pivot on:

Endpoint IP

Destination IP

Domain

Time Window

44. Step 40 — Review IDS/IPS Alerts

Search Suricata or equivalent telemetry.

Record:

Signature:

Category:

Severity:

Source:

Destination:

Timestamp:

Determine whether the IDS evidence correlates with endpoint activity.

45. Step 41 — Investigate Potential Command-and-Control

Look for:

Repeated External Connections

Periodic Communication

Rare Destinations

Suspicious DNS

Unexpected Ports

Connections from Malware Process

Long-Lived Sessions

Encrypted Communication to Unusual Infrastructure

Classify:

C2:
Confirmed / Suspected / Not Observed / Unknown

46. Step 42 — Investigate Download Activity

Determine whether suspicious processes retrieved additional files.

Look for:

URL

Domain

Downloaded Filename

Destination Path

Hash

Downloading Process

Timestamp

This may indicate additional payload delivery.

47. Step 43 — Investigate Additional Payloads

Create a table:

File	Path	Hash	Parent/Creator	Assessment
`<file>`	`<path>`	`<SHA-256>`	`<process>`	Suspicious

Each additional artifact should be analyzed independently.

48. Step 44 — Investigate Credential Access Indicators

Look for evidence involving:

Credential Stores

Browser Credentials

Authentication Tokens

Password Databases

Unexpected Access to Authentication Processes

Credential-Dumping Alerts

Do not perform credential-dumping techniques during investigation.

Classify:

Credential Access:
Confirmed / Suspected / Not Observed / Unknown

49. Step 45 — Investigate Discovery Activity

Look for evidence of:

System Discovery

User Discovery

Network Discovery

Domain Discovery

Process Discovery

Service Discovery

File Discovery

Security-Software Discovery

Discovery activity can indicate post-compromise behavior.

50. Step 46 — Investigate Internal Connections

Determine whether the endpoint contacted:

Workstations

Servers

Domain Controllers

File Servers

Database Servers

Cloud Resources

after the suspicious execution.

51. Step 47 — Investigate Lateral Movement

Look for:

RDP

SMB

SSH

WinRM

Remote Services

Administrative Shares

Remote Authentication

Record:

Source Host:

Destination Host:

Identity:

Protocol:

Timestamp:

Outcome:

52. Step 48 — Distinguish Contact from Compromise

A connection to another endpoint does not prove that endpoint was compromised.

Use:

Network Connection
      +
Authentication
      +
Remote Execution / Malicious Activity
      =
Stronger Evidence of Lateral Movement

Classify destinations separately.

53. Step 49 — Investigate Data Collection

Look for:

Sensitive Directory Access

File Enumeration

Database Access

Archive Creation

Large File Reads

Clipboard Activity

Screenshot Collection

where telemetry supports it.

54. Step 50 — Investigate Archive Creation

Look for unexpected:

ZIP

7z

RAR

tar

gzip

activity.

Record:

Archive:

Source Files:

Creating Process:

User:

Timestamp:

Size:

Archive creation can indicate staging but is not proof of exfiltration.

55. Step 51 — Investigate Potential Exfiltration

Review:

Outbound Connections

Large Transfers

Cloud Storage

Web Uploads

FTP/SFTP

Email

Unusual External Services

Correlate with data collection or archive creation.

Classify:

Exfiltration:
Confirmed / Suspected / Not Observed / Unknown

56. Step 52 — Build the IOC Inventory

Create:

IOC Type	Indicator	Source	Confidence
Hash	`<SHA-256>`	EDR	High
File	`<filename>`	Endpoint	High
Domain	`<domain>`	DNS	Medium/High
IP	`<IP>`	Network	Medium/High
URL	`<URL>`	Process/Proxy	High
Registry	`<key>`	Endpoint	Medium

57. Step 53 — Enrich Significant IOCs

For each IOC, document:

Reputation:

Classification:

Threat Association:

First Seen:

Last Seen:

Related Indicators:

Confidence:

Use multiple sources when practical.

58. Step 54 — Hunt the Hash Across the Environment

Search:

SHA-256

across:

EDR

SIEM

File Telemetry

Email Security

Determine whether the artifact exists on additional systems.

59. Step 55 — Hunt the Filename

Search:

Filename

but remember:

Filename
≠
Unique Indicator

Attackers can rename malware, and legitimate files may share common names.

60. Step 56 — Hunt Domains and IPs

Search:

Domain

Destination IP

across:

DNS

Firewall

Proxy

Zeek

Suricata

EDR

Determine which other endpoints communicated with the infrastructure.

61. Step 57 — Hunt Process Behavior

Hash-based detection alone may miss modified malware.

Search for related behavior such as:

Same Parent-Child Relationship

Same Command-Line Pattern

Same Persistence Mechanism

Same Domain

Same Destination

Same File Path

Behavioral hunting can identify related variants.

62. Step 58 — Build the Master Endpoint Timeline

Create:

Time	Event	Process/User	Evidence
14:02	File downloaded	browser	Proxy
14:05	File created	user01	EDR
14:07	File executed	user01	Process
14:07	PowerShell spawned	malware	EDR
14:08	DNS query	endpoint	DNS
14:08	External connection	malware	Network
14:10	Scheduled task created	user01	Endpoint
14:15	Internal connection	endpoint	Network

Use actual investigation evidence.

63. Step 59 — Identify the Earliest Suspicious Activity

Move backward from the malware detection.

You may discover:

EDR Alert:
14:35

but:

Initial Download:
13:58

or:

Phishing Delivery:
13:42

The detection time is not necessarily the compromise time.

64. Step 60 — Determine Initial Access

Possible conclusions:

Phishing

Malicious Download

Compromised Credentials

Public-Facing Application

Remote Access

Removable Media

Supply Chain

Unknown

Only classify when supported by evidence.

65. Step 61 — Build the Endpoint Attack Story

Example:

Phishing Email
      ↓
Attachment Download
      ↓
User Execution
      ↓
PowerShell
      ↓
Payload Download
      ↓
Persistence
      ↓
External Communication
      ↓
Discovery
      ↓
Credential Activity
      ↓
Lateral Movement

Every transition should have supporting evidence.

66. Step 62 — Map Observed Activity to MITRE ATT&CK

Create:

Stage	Observed Behavior	ATT&CK Technique
Initial Access	`<evidence>`	`<technique>`
Execution	`<evidence>`	`<technique>`
Persistence	`<evidence>`	`<technique>`
Privilege Escalation	`<evidence>`	`<technique>`
Defense Evasion	`<evidence>`	`<technique>`
Credential Access	`<evidence>`	`<technique>`
Discovery	`<evidence>`	`<technique>`
Lateral Movement	`<evidence>`	`<technique>`
C2	`<evidence>`	`<technique>`
Exfiltration	`<evidence>`	`<technique>`
Impact	`<evidence>`	`<technique>`

Do not map techniques that were not observed.

67. Step 63 — Determine Endpoint Compromise Status

Use:

Not Compromised

Artifact blocked before execution
and no malicious follow-on activity observed.

Suspected Compromise

Suspicious execution or behavior exists,
but available evidence is incomplete.

Confirmed Compromise

Malicious execution and/or unauthorized
post-compromise activity is supported by evidence.

Unknown

Telemetry is insufficient for determination.

68. Step 64 — Determine Environment Scope

Classify each asset:

Asset	Evidence	Status
WIN01	Malware execution	Confirmed Compromised
WIN02	Same domain contacted	Investigate
FILE01	SMB connection	Exposed / Contacted
WIN03	No evidence	Unaffected

Use:

Confirmed Compromised

Suspected Compromised

Exposed / Contacted

Unaffected

Unknown

69. Step 65 — Determine Identity Scope

Identify:

User logged into endpoint

Accounts used after compromise

Privileged identities

Service accounts

Remote identities

Classify:

Confirmed Compromised

Suspected

Used on Compromised Host

Unaffected

Unknown

70. Step 66 — Assess Confidentiality Impact

Ask:

Were credentials accessed?

Were sensitive files accessed?

Was data collected?

Was data staged?

Was data transferred externally?

Classify:

None

Low

Moderate

High

Unknown

71. Step 67 — Assess Integrity Impact

Ask:

Were files modified?

Was persistence created?

Were accounts changed?

Were security controls modified?

Were configurations changed?

72. Step 68 — Assess Availability Impact

Ask:

Were files encrypted?

Were files deleted?

Were services stopped?

Was the endpoint unavailable?

Was business functionality affected?

73. Step 69 — Assign Severity

Low

Malicious artifact blocked before execution

No persistence

No network activity

No compromise evidence

Medium

Suspicious execution

Limited endpoint impact

Compromise not fully confirmed

High

Confirmed malware execution

Persistence

C2

Credential access

Lateral movement

Sensitive asset involvement

Critical

Ransomware

Destructive malware

Widespread compromise

Critical server compromise

Major data exfiltration

Domain-wide compromise

74. Step 70 — Determine Threat Status

Classify:

Active

Contained

Historical

Unknown

Check:

Is malware still running?

Is persistence active?

Are connections continuing?

Are new systems being contacted?

Are new detections appearing?

75. Step 71 — Determine Immediate Containment

For confirmed or highly suspected endpoint compromise, consider:

Isolate Endpoint

Terminate Malicious Process

Quarantine Artifact

Block Hash

Block Domain

Block IP

Secure Compromised Identity

Revoke Sessions

Restrict Internal Access

Only perform actions within your authorization.

76. Isolation vs Shutdown

In many investigations:

Network Isolation

may preserve more volatile evidence than:

Immediate Shutdown

But response depends on:

Threat Behavior

Business Impact

Evidence Requirements

Incident Response Procedures

Follow organizational policy.

77. Step 72 — Preserve Evidence

Before destructive remediation, consider collecting:

EDR Telemetry

Process Tree

Running Processes

Network Connections

DNS Evidence

Suspicious Files

File Hashes

Persistence Evidence

Authentication Logs

Relevant Event Logs

Memory

Screenshots

78. Step 73 — Avoid Premature Remediation

Do not immediately:

Delete Malware

Clear Logs

Remove Persistence

Restart Endpoint

Reimage Endpoint

without considering:

Evidence Preservation

Threat Scope

Business Requirements

Incident Response Procedures

79. Step 74 — Develop Eradication Actions

Depending on findings:

Remove Malware

Remove Persistence

Patch Vulnerabilities

Remove Unauthorized Accounts

Rotate Credentials

Reset MFA

Remove Malicious Services

Remove Scheduled Tasks

Correct Security Misconfigurations

For high-confidence compromise, rebuilding from a trusted image may be preferable to manually attempting to clean every artifact.

80. Step 75 — Develop Recovery Actions

Include:

Restore from Known-Good State

Validate Endpoint Integrity

Patch System

Update Security Controls

Reconnect Gradually

Increase Monitoring

Verify Authentication

Confirm No Recurrence

81. Step 76 — Enterprise Hunt After Containment

Do not stop with the first compromised endpoint.

Search for:

Hashes

Domains

IPs

URLs

File Paths

Process Patterns

Command Lines

Persistence Mechanisms

User Accounts

across the environment.

82. Step 77 — Escalation Criteria

Escalate when:

Malware executed

Endpoint compromise confirmed

Persistence established

Credential access suspected

Privileged account involved

C2 observed

Lateral movement detected

Multiple endpoints affected

Sensitive data accessed

Exfiltration suspected

Ransomware detected

Security controls disabled

83. Endpoint Escalation Template

Use:

Case ID:

Classification:

Severity:

Endpoint:

IP:

User:

Asset Criticality:

Detection:

File:

Path:

SHA-256:

Execution:
Confirmed / Blocked / Unknown

Parent Process:

Command Line:

Persistence:

Privilege:

Credential Access:

DNS Activity:

Network Activity:

C2:

Lateral Movement:

Potential Data Access:

Threat Intelligence:

Affected Systems:

Affected Identities:

Threat Status:

Evidence Preserved:

Containment Performed:

Recommended Action:

Outstanding Questions:

Escalated To:

84. Example Confirmed Endpoint Compromise

Case:
ENDPOINT-2026-044

Classification:
Confirmed Endpoint Compromise

Severity:
High

Endpoint:
FIN-WIN23

User:
user01

Initial Evidence:
EDR detected an unknown executable running
from the user's temporary directory.

Execution:
Confirmed.

Process Tree:
WINWORD.EXE
   ↓
powershell.exe
   ↓
update.exe

Persistence:
A scheduled task referencing update.exe
was identified.

Network:
update.exe queried an unusual domain and
established an outbound connection.

Threat Intelligence:
The file hash and destination infrastructure
are associated with malicious activity.

Scope:
FIN-WIN23 confirmed compromised.
Additional endpoints are being hunted.

Recommended Response:
Isolate FIN-WIN23, secure user01,
preserve evidence, block validated indicators,
remove persistence during eradication, and
perform enterprise-wide IOC hunting.

Escalation:
Incident Response.

85. Example Blocked Malware Alert

Classification:
Malicious Artifact Blocked

Endpoint:
HR-WIN11

Detection:
Known malicious executable.

EDR Action:
Blocked before execution and quarantined.

Execution:
No process execution identified.

Persistence:
Not observed.

Network:
No related communication identified.

Additional Hosts:
No hash matches identified.

Impact:
No confirmed endpoint compromise.

Severity:
Low

Disposition:
Close or monitor according to organizational policy.

Recommendation:
Determine delivery source and verify whether
other users received the same artifact.

86. Example Suspicious but Inconclusive Investigation

Classification:
Suspected Endpoint Compromise

Evidence:
Suspicious PowerShell activity identified.

Command:
Obfuscated content observed.

Network:
Connection to previously unseen external infrastructure.

Malware:
No known malicious hash identified.

Persistence:
Not observed.

Limitation:
Endpoint telemetry prior to the alert is incomplete.

Severity:
Medium / High

Disposition:
Escalate for deeper endpoint analysis.

Confidence:
Medium

87. Analyst Action Log

Record:

Time	Analyst Action	Result
14:36	Reviewed EDR alert	Suspicious executable identified
14:39	Checked execution	Process execution confirmed
14:42	Built process tree	PowerShell parent identified
14:47	Calculated hash	SHA-256 recorded
14:52	Enriched hash	Malicious reputation identified
14:57	Reviewed DNS	Suspicious domain found
15:02	Reviewed network	External connection confirmed
15:08	Checked persistence	Scheduled task identified
15:15	Searched environment	No additional hash matches
15:20	Escalated	IR notified

88. Common Analyst Mistakes

Avoid:

Assuming detection means execution

Assuming quarantine means no compromise

Looking only at the malicious file

Ignoring the process tree

Ignoring parent processes

Ignoring command-line arguments

Ignoring PowerShell

Ignoring persistence

Ignoring user context

Ignoring privilege context

Ignoring DNS

Ignoring outbound network activity

Ignoring internal connections

Treating contacted hosts as compromised

Relying only on file hashes

Ignoring behavioral indicators

Deleting malware before evidence preservation

Reimaging before scope determination

Failing to hunt across other endpoints

89. Rapid Endpoint Triage Checklist

□ Original alert preserved

□ Endpoint identified

□ User identified

□ Asset criticality established

□ Detection action identified

□ Suspicious artifact identified

□ File type verified

□ SHA-256 calculated

□ Threat intelligence checked

□ Execution status determined

□ Process identified

□ Parent process identified

□ Process tree built

□ Command line reviewed

□ PowerShell reviewed

□ File creation reviewed

□ Persistence investigated

□ Privilege activity reviewed

□ Security-control tampering checked

□ DNS activity reviewed

□ Network activity reviewed

□ C2 assessed

□ Credential access assessed

□ Discovery assessed

□ Internal connections reviewed

□ Lateral movement assessed

□ Data collection assessed

□ Exfiltration assessed

□ IOCs extracted

□ Environment-wide IOC hunt performed

□ Endpoint scope determined

□ Identity scope determined

□ Severity assigned

□ Threat status determined

□ Evidence preserved

□ Containment considered

□ Escalation decision made

□ Case documented

90. Investigation Documentation Template

# Malware and Endpoint Compromise Investigation

## Case Information

Case ID:

Analyst:

Date:

## Detection

Alert:

Detection Source:

Detection Time:

Detection Action:

## Endpoint

Hostname:

IP:

Operating System:

Asset Criticality:

Business Function:

## User

Username:

Privilege:

Session:

## Suspicious Artifact

Filename:

Path:

Actual File Type:

Size:

Created:

Executed:

SHA-256:

## Threat Intelligence

Classification:

Malware Family:

Related Infrastructure:

Confidence:

## Execution

Status:

Process:

PID:

User:

Command Line:

## Process Tree

Document complete process lineage.

## PowerShell / Script Activity

Document findings.

## File Activity

Document created and modified files.

## Persistence

Scheduled Tasks:

Services:

Registry:

Startup:

Accounts:

Other:

## Privilege Activity

Document findings.

## Defense Evasion

Document security-control tampering or log clearing.

## DNS Activity

Document suspicious queries.

## Network Activity

Document:
- destinations
- ports
- protocols
- processes
- connection times

## Command-and-Control

Confirmed / Suspected / Not Observed / Unknown

Evidence:

## Credential Access

Confirmed / Suspected / Not Observed / Unknown

Evidence:

## Discovery

Document findings.

## Lateral Movement

Source:

Destination:

Identity:

Protocol:

Outcome:

## Data Collection

Document findings.

## Exfiltration

Confirmed / Suspected / Not Observed / Unknown

Evidence:

## IOC Inventory

Document:
- hashes
- files
- domains
- IPs
- URLs
- registry indicators

## Enterprise Hunt

Document matches across other systems.

## Timeline

Create chronological incident timeline.

## MITRE ATT&CK Mapping

Document evidence-supported techniques.

## Endpoint Scope

Confirmed Compromised:

Suspected:

Exposed / Contacted:

Unaffected:

Unknown:

## Identity Scope

Document affected identities.

## Impact

### Confidentiality

### Integrity

### Availability

## Compromise Assessment

Not Compromised / Suspected / Confirmed / Unknown

## Severity

Low / Medium / High / Critical

## Threat Status

Active / Contained / Historical / Unknown

## Evidence Preserved

Document evidence and hashes.

## Containment

Document completed or recommended actions.

## Eradication

Document recommendations.

## Recovery

Document recommendations.

## Escalation

Escalated:
Yes / No

Escalated To:

## Outstanding Questions

Document investigation gaps.

## Final Analyst Assessment

Summarize the incident.

## Disposition

Close / Monitor / Continue Investigation / Escalate

91. Runbook Validation Checklist

Detection

Original alert preserved
Detection mechanism understood
Detection action determined
Execution status determined

Endpoint

Host identified
Asset criticality established
User identified
Privilege context established
Investigation window established

Artifact

Suspicious file identified
Actual file type verified
SHA-256 calculated
Artifact preserved where required
Threat intelligence reviewed

Execution

Process identified
Parent process identified
Process tree constructed
Command line analyzed
PowerShell investigated
Script activity investigated

Persistence

Scheduled tasks reviewed
Services reviewed
Registry persistence reviewed
Startup locations reviewed
Account creation reviewed
Linux persistence reviewed where relevant

Post-Compromise Activity

Privilege activity investigated
Security-control tampering investigated
Log clearing investigated
Credential access assessed
Discovery activity assessed
Data collection assessed

Network

DNS activity reviewed
Network connections reviewed
Process-to-network relationship established
IDS/IPS alerts reviewed
C2 assessed
Download activity investigated
Additional payloads investigated

Lateral Movement

Internal connections reviewed
Authentication correlated
Remote execution investigated
Contacted vs compromised systems distinguished

Threat Hunting

IOC inventory created
Hash searched environment-wide
Filename searched
Domains searched
IPs searched
Behavioral indicators hunted
Additional affected systems identified

Incident Reconstruction

Earliest suspicious activity identified
Initial access assessed
Master timeline created
Attack story reconstructed
MITRE ATT&CK mapping completed

Impact

Endpoint scope established
Identity scope established
Confidentiality assessed
Integrity assessed
Availability assessed
Exfiltration assessed

Response

Compromise status assigned
Severity assigned
Threat status determined
Evidence preserved
Containment evaluated
Eradication recommendations created
Recovery recommendations created
Escalation criteria evaluated

Documentation

Analyst actions recorded
Evidence sources documented
Confidence levels documented
Outstanding questions recorded
Final disposition documented

92. Runbook Summary

A malware investigation should never stop at:

Malware Detected
      ↓
Delete File

A professional investigation follows:

Detection
   ↓
Execution?
   ↓
Process Tree
   ↓
Command Line
   ↓
File Activity
   ↓
Persistence
   ↓
Privilege
   ↓
Credential Activity
   ↓
DNS / Network
   ↓
C2
   ↓
Internal Movement
   ↓
Data Activity
   ↓
Scope
   ↓
Containment
   ↓
Eradication
   ↓
Recovery

The key operational lesson is:

The presence of malware is only one part of the investigation. The analyst must determine what executed, what changed, where the malware communicated, whether persistence or lateral movement occurred, and how far the compromise spread.

A strong endpoint investigation combines:

EDR Telemetry
      +
Process Analysis
      +
File Evidence
      +
Persistence Evidence
      +
Identity Context
      +
Network Telemetry
      +
Threat Intelligence
      +
Enterprise Hunting
      =
Endpoint Compromise Assessment

What’s Next?

CySA+ Runbook 05 — Network Security Alert Investigation

The next runbook moves from endpoint telemetry to network-focused investigation.

You will build a repeatable procedure for investigating:

IDS/IPS alerts
suspicious network connections
source and destination analysis
ports and protocols
Zeek telemetry
Suricata alerts
packet captures
DNS activity
HTTP/HTTPS activity
TLS metadata
network scanning
brute-force traffic
beaconing
command-and-control indicators
suspicious outbound communication
internal lateral movement
IOC enrichment
affected-host identification
network containment
escalation

The workflow progresses from:

Network Alert
      ↓
Validate Detection
      ↓
Source / Destination
      ↓
Protocol Analysis
      ↓
Flow / Packet Analysis
      ↓
DNS / HTTP / TLS
      ↓
Endpoint Correlation
      ↓
Threat Intelligence
      ↓
Scope
      ↓
Compromise Assessment
      ↓
Containment
      ↓
Escalation

➡️ Next: CySA+ Runbook 05 — Network Security Alert Investigation