Lab 07 Malware & Endpoint Investigation

Mission Overview

Welcome to Lab 07 — Malware & Endpoint Investigation.

In Lab 06, you investigated phishing and determined whether users interacted with suspicious links or attachments.

Now you will investigate what happens when an endpoint security product generates a malware or suspicious-process alert.

A malware alert is not the same as a compromised endpoint.

The SOC must determine:

• what file or process triggered the alert

• whether execution occurred

• which user was involved

• what launched the process

• what child processes appeared

• what files or system changes occurred

• whether the endpoint communicated externally

• whether persistence was established

• whether the same indicators appear elsewhere

• whether containment is required

Mission Goal: Investigate a simulated malware or endpoint alert, reconstruct the execution chain, determine the extent of endpoint impact, identify related systems and indicators, and produce an evidence-based containment and escalation decision.

Mission Information

Item	Details
Difficulty	Intermediate
Estimated Time	120–150 minutes
Primary Skill	Endpoint Security Investigation
Secondary Skill	Malware Alert Analysis
Environment	GoHackersCloud SOC Analyst Lab
Evidence	Simulated EDR/SIEM/host/network telemetry
Primary Outcome	Endpoint Investigation Report
Safety Level	Authorized Training Evidence Only

Learning Objectives

By completing this lab, you will be able to:

• investigate endpoint security alerts

• distinguish detection from execution

• identify the affected host and user

• analyze file metadata

• analyze file hashes

• interpret process trees

• investigate parent-child process relationships

• review command-line evidence

• identify suspicious file creation

• analyze endpoint network activity

• identify persistence indicators conceptually

• correlate endpoint events with DNS and proxy logs

• search for indicators across other systems

• determine endpoint scope

• determine incident scope

• assign severity and confidence

• make containment recommendations

• prepare an escalation package

• produce a professional endpoint investigation report

Investigation Methodology

Use:

Endpoint Alert → File/Process → Execution → Parent/Child → File/System Changes → Network → Persistence → Scope → Impact

Conceptually:

Endpoint Alert
      │
      ▼
Affected Host
      │
      ▼
User Context
      │
      ▼
File / Process
      │
      ▼
Executed?
      │
  ┌───┴────┐
  │        │
  No       Yes
  │        │
  ▼        ▼
Blocked   Process Tree
           │
           ├── Child Processes
           ├── Files
           ├── Registry/System
           ├── Services/Tasks
           └── Network
           │
           ▼
       Scope Analysis
           │
           ▼
   Contain / Escalate / Close

The core principle is:

Detection is evidence of a security control event. Execution and impact must be established separately.

Part 1 — Create the Investigation Workspace

Create:

SOC-Labs/
└── Lab-07/
    ├── 01-Scope/
    ├── 02-Alert/
    ├── 03-Host-Context/
    ├── 04-User-Context/
    ├── 05-File-Analysis/
    ├── 06-Process-Analysis/
    ├── 07-File-System-Changes/
    ├── 08-Persistence/
    ├── 09-Network/
    ├── 10-IOC-Correlation/
    ├── 11-Scope/
    ├── 12-Timeline/
    ├── 13-Evidence/
    ├── 14-Findings/
    └── 15-Report/

Create:

Lab-07-Malware-Endpoint-Investigation.md

Part 2 — Open the Case

Example:

CASE ID:
GHC-SOC-2026-007

CASE TITLE:
Malware & Endpoint Investigation

STATUS:
Investigating

INITIAL PRIORITY:
P2

ANALYST:

DATE:

Part 3 — Review the Initial Endpoint Alert

Assume:

ALERT ID:
ALT-EDR-001

ALERT:
Suspicious Executable Detected

HOST:
WIN-FIN-02

USER:
finance-user

FILE:
InvoiceViewer.exe

LOCATION:
User Downloads

DETECTION:
Malware / Suspicious File

ACTION:
Quarantined

INITIAL SEVERITY:
High

PROCESS EXECUTION:
Unknown

Do not immediately conclude:

Endpoint compromised.

Start with:

Was the file merely detected, or did it execute?

Part 4 — Record the Alert Metadata

Create:

ENDPOINT ALERT PROFILE

Alert ID:

Detection Name:

Timestamp:

Host:

User:

File:

File Path:

File Hash:

Process:

Parent Process:

Command Line:

Detection Engine:

Action Taken:

Execution Status:

Network Activity:

Initial Severity:

Evidence Reference:

Part 5 — Validate Host Context

Create:

HOST PROFILE

Hostname:

IP:

Operating System:

Department:

Business Role:

Criticality:

Owner:

Expected User:

Endpoint Protection:

Logging Status:

Isolation Capability:
Yes / No / Unknown

Part 6 — Validate User Context

Record:

USER PROFILE

User:

Department:

Role:

Privileged:
Yes / No

Expected Host:

Normal Applications:

Recent Email Incident:
Yes / No / Unknown

Recent Authentication Alert:
Yes / No / Unknown

This may connect the case with Lab 06.

Part 7 — Determine Whether the File Was Delivered

Possible sources include:

• email attachment

• web download

• shared drive

• removable media

• software deployment

• existing file

Create:

FILE DELIVERY PROFILE

Filename:

Source:

First Seen:

Downloaded:
Yes / No / Unknown

Email Related:
Yes / No / Unknown

Browser Related:
Yes / No / Unknown

Expected Software:
Yes / No / Unknown

Part 8 — Capture File Metadata

Record:

FILE METADATA

Filename:

Path:

Size:

Created:

Modified:

Hash:

Type:

Signer:
If supplied

Source:

Quarantine Status:

Do not execute the file.

Part 9 — Use File Hashes Carefully

A hash may help correlate:

• EDR detections

• gateway detections

• sandbox results

• other hosts

Remember:

Malicious Hash Match
      ≠
Execution Proven

It proves the file matches the referenced content, not that it ran.

Part 10 — Build the File Evidence Register

File ID	Filename	Hash	Host	Detection	Executed
FILE-01	InvoiceViewer.exe		WIN-FIN-02	Malicious	Unknown

Part 11 — Determine Execution Status

This is one of the most important phases.

Look for:

• process creation

• endpoint execution event

• parent-child relationship

• command line

• execution timestamp

• security-control action

Classify:

Not Executed

Execution Blocked

Executed

Execution Suspected

Unknown

Part 12 — Example — Detection Before Execution

Suppose evidence shows:

File Downloaded:
10:05

EDR Detection:
10:05:02

Action:
Quarantined

Process Creation:
None

Child Processes:
None

Disposition may be:

Malicious File Detected — Execution Not Observed

Part 13 — Example — Execution Confirmed

Suppose:

10:05
File downloaded

10:06
InvoiceViewer.exe launched

10:06
Child process created

10:07
External network connection

Now the case requires deeper analysis.

Part 14 — Build the Execution Register

Time	File/Process	Event	User	Evidence
		Downloaded
		Executed
		Blocked

Part 15 — Analyze the Parent Process

A process does not appear in isolation.

Ask:

What launched it?

Possible parents:

• browser

• email client

• explorer

• command shell

• Office application

• management software

• another suspicious process

Part 16 — Build the Parent-Child Process Tree

Example:

outlook.exe
     │
     ▼
InvoiceViewer.exe
     │
     ├── powershell.exe
     └── cmd.exe

Or:

chrome.exe
   │
   ▼
InvoiceViewer.exe

Do not infer malicious intent from one child process alone.

Part 17 — Create the Process Tree Register

Process	Parent	User	Time	Assessment
InvoiceViewer.exe	explorer.exe	finance-user
powershell.exe	InvoiceViewer.exe	finance-user

Part 18 — Analyze Command-Line Evidence

If provided, record:

PROCESS COMMAND LINE

Process:

Parent:

Command Line:

User:

Time:

Expected:

Security Relevance:

Do not guess missing command lines.

If unavailable:

Telemetry Gap:
Command-line evidence unavailable.

Part 19 — Review Child Processes

Ask:

Did the process create children?

Were those processes expected?

Did any child process access the network?

Did any child process make system changes?

Create:

Parent	Child	User	Network	Assessment

Part 20 — Correlate File-System Changes

Review available endpoint evidence for:

• newly created files

• modified files

• files written to startup locations

• dropped components

• archive extraction

• temporary files

Do not browse unrelated user files.

Part 21 — Build the File-System Change Register

Time	File	Path	Action	Process
			Created

Part 22 — Distinguish File Creation from Execution

Always separate:

File Created
    ≠
File Executed

and:

File Executed
    ≠
Successful Malicious Action

Part 23 — Review Registry/System Changes Where Available

If endpoint telemetry supplies Windows registry or system changes, inspect relevant evidence.

Potential categories include:

• startup configuration

• security-setting changes

• application settings

• persistence-related entries

Do not modify the registry.

Part 24 — Build the System Change Register

Time	Type	Object	Process	Assessment
	Registry/System

Part 25 — Investigate Persistence Indicators

Possible evidence can include:

• scheduled task

• service creation

• startup entry

• login-start configuration

• recurring execution

Your role is to identify supplied evidence, not create persistence.

Remember:

Scheduled Task
    ≠
Malicious Persistence Automatically

New Service
    ≠
Persistence Automatically

Part 26 — Create the Persistence Register

Mechanism	Observed	Process/User	Expected
Scheduled task
Service
Startup entry
Other

Part 27 — Correlate Endpoint Network Activity

Investigate:

• destination IP

• domain

• port

• protocol

• process

• timestamp

• allowed/blocked

Create:

NETWORK EVENT

Time:

Host:

Process:

Destination:

Domain:

Port:

Protocol:

Action:

Expected:

Assessment:

Part 28 — Build the Network Connection Register

Time	Process	Destination	Port	Action	Assessment

Part 29 — Correlate DNS Evidence

Search DNS telemetry around process execution.

Example:

InvoiceViewer.exe
       ↓
DNS Query
       ↓
suspicious-domain.example.test

Record:

Time	Client	Domain	Process	Assessment

Part 30 — Correlate Proxy/Web Evidence

If a suspicious process or browser interaction appears, correlate:

• URL

• domain

• user

• host

• response

• allowed/blocked

• download

Build:

WEB ACTIVITY

Time:

User:

Host:

URL:

Destination:

Result:

File Download:
Yes / No / Unknown

Assessment:

Part 31 — Distinguish Network Attempt from Successful Communication

Remember:

Connection Attempt
      ≠
Connection Established

and:

Connection Established
      ≠
Data Exfiltration

Evidence must support each claim.

Part 32 — Investigate Security-Control Outcome

Determine whether the endpoint tool:

Detected

Blocked

Killed Process

Quarantined File

Isolated Host

Allowed

Unknown

Create:

CONTROL OUTCOME

Detection:

Execution Prevention:

Process Terminated:

File Quarantined:

Network Blocked:

Host Isolated:

Additional Alerting:

Part 33 — Identify Positive Security Controls

Examples:

• file blocked before execution

• process terminated

• malicious connection blocked

• file quarantined

• endpoint automatically isolated

• user lacked administrative rights

• MFA protected the identity

Document these.

Part 34 — Build the Endpoint Security Control Matrix

Control	Status	Evidence
Antivirus/EDR
Execution prevention
File quarantine
Network protection
Host isolation
Least privilege

Part 35 — Search for the Same Hash Across Hosts

Using the supplied SIEM/EDR data, search for:

File Hash

Create:

Host	Hash Seen	Executed	Action
WIN-FIN-02	Yes	Yes	Investigating
WIN-HR-04	Yes	No	Quarantined

Part 36 — Search for the Same Filename

Filename searches may help identify campaign spread.

But remember:

Same Filename
    ≠
Same File

Hashes provide stronger file identity where available.

Part 37 — Search for the Same Domain/IP

Search authorized telemetry for:

• destination domain

• destination IP

• URL

• file hash

This helps determine whether one endpoint or many endpoints are involved.

Part 38 — Build the IOC Correlation Matrix

IOC	Endpoint	DNS	Proxy	Firewall	Email
Hash	✓
Domain		✓	✓
URL			✓		✓
IP				✓

Part 39 — Connect Back to the Phishing Case

If Lab 06 contained a related email:

Phishing Email
      ↓
Attachment / Link
      ↓
User Interaction
      ↓
Endpoint Alert

Correlate:

• recipient

• attachment hash

• URL

• host

• user

• timeline

Part 40 — Build the Email-to-Endpoint Correlation Register

Evidence	Email	Endpoint	Match
User	finance-user	finance-user	Yes
File	InvoiceViewer.exe	InvoiceViewer.exe	Yes
Hash
Time

Part 41 — Investigate Authentication After Execution

If endpoint activity suggests credential access or browser interaction, review identity telemetry.

Look for:

• unexpected authentication

• new session

• unusual source

• MFA activity

• privileged login

Use the Lab 03 methodology.

Part 42 — Build the Identity Correlation Register

Time	User	Authentication	Source	Expected

Part 43 — Determine Privilege Context

Ask:

Was the affected user privileged?

Did the suspicious process run as administrator?

Did it obtain elevated context?

Were privileged actions observed?

Do not claim privilege escalation without evidence.

Part 44 — Build the Privilege Context Register

USER:

Privilege Level:

Process Context:

Administrative Rights:
Yes / No / Unknown

Privilege Change Observed:
Yes / No

Evidence:

Part 45 — Determine Endpoint Impact

Classify observed impact:

File Present Only

Execution Blocked

Execution Confirmed

System Changes Observed

Network Communication Observed

Persistence Indicators Observed

Credential Risk

Multiple Hosts Affected

Part 46 — Create the Endpoint Impact Matrix

Impact	Confirmed	Evidence
File present
Executed
Child process
File change
System change
Network communication
Persistence
Credential impact

Part 47 — Determine Host Scope

Ask:

One host?

Multiple hosts?

Same hash?

Same domain?

Same user?

Same process?

Create:

Host	File	Execution	Network	Status
WIN-FIN-02	Yes	Yes	Yes	Investigating
WIN-HR-04	Yes	No	No	Blocked

Part 48 — Determine User Scope

Create:

USER SCOPE

Primary User:

Other Users:

Privileged Users:

Users Who Received File:

Users Who Executed File:

Potential Credential Exposure:

Part 49 — Determine Process Scope

Create:

PROCESS SCOPE

Primary Process:

Parent:

Child Processes:

Hosts:

Users:

First Seen:

Last Seen:

Network Destinations:

Known Impact:

Part 50 — Determine IOC Scope

Create:

IOC SCOPE

Hash Hits:

Domain Hits:

IP Hits:

URL Hits:

Endpoints:

Users:

First Seen:

Last Seen:

Part 51 — Build the Master Endpoint Timeline

Example:

09:55
Phishing email delivered

10:02
Attachment downloaded

10:03
File created on WIN-FIN-02

10:04
File executed

10:04
Child process created

10:05
DNS query observed

10:05
Outbound connection attempted

10:06
EDR alert generated

10:06
Process terminated

10:07
File quarantined

10:10
SOC case opened

Only include evidence-supported events.

Part 52 — Normalize Time

Correlate:

• EDR

• Windows logs

• DNS

• proxy

• firewall

• email

• identity logs

Use the same master timezone.

Part 53 — Build Investigation Hypotheses

Hypothesis 1 — False Positive

Known legitimate application
+
expected user
+
approved software
+
no suspicious behavior

Hypothesis 2 — Malicious File Blocked Before Execution

Malicious detection
+
file quarantined
+
no process creation
+
no network activity

Hypothesis 3 — Malicious Execution with Limited Impact

Execution confirmed
+
process terminated quickly
+
no persistence
+
limited network activity

Hypothesis 4 — Potential Endpoint Compromise

Execution
+
child processes
+
system changes
+
network activity
+
unexplained persistence indicators

Part 54 — Create the Hypothesis Matrix

Hypothesis	Supporting Evidence	Contradicting Evidence	Confidence
False positive
Blocked before execution
Limited execution
Endpoint compromise

Part 55 — Determine the Disposition

Use:

Benign / False Positive

Evidence supports legitimate activity.

Malicious File — Blocked

File was malicious or policy-violating but execution was prevented.

Suspicious Endpoint Activity

Evidence requires deeper investigation.

Malware Execution Confirmed

Execution occurred.

This does not automatically describe full compromise scope.

Potential Endpoint Compromise

Multiple correlated indicators suggest meaningful host impact.

Confirmed Security Incident

Evidence clearly demonstrates unauthorized malicious endpoint activity.

Inconclusive

Evidence is insufficient.

Part 56 — Example — File Blocked Before Execution

DISPOSITION:
Malicious File — Execution Prevented

HOST:
WIN-FIN-02

USER:
finance-user

EVIDENCE:
The suspicious file was downloaded to the endpoint.

Endpoint protection identified and quarantined the file before
process creation was observed.

No child processes or related outbound communications were found
during the reviewed window.

KNOWN IMPACT:
Malicious file reached the endpoint but execution was not observed.

SEVERITY:
Medium

CONFIDENCE:
High

Part 57 — Example — Malware Execution Confirmed

DISPOSITION:
Confirmed Malware Execution

HOST:
WIN-FIN-02

USER:
finance-user

EVIDENCE:
InvoiceViewer.exe was executed from the user's Downloads directory.

Endpoint telemetry recorded child-process activity shortly after
execution.

Related DNS and network activity was observed.

The endpoint security product terminated the process.

PERSISTENCE:
Not confirmed.

KNOWN IMPACT:
Malicious code execution occurred on one endpoint.

SEVERITY:
High

CONFIDENCE:
High

ESCALATION:
Required.

Part 58 — Example — Potential Endpoint Compromise

DISPOSITION:
Potential Endpoint Compromise

EVIDENCE:
Suspicious executable ran successfully.

Additional process activity and system changes occurred afterward.

The affected endpoint communicated with an unexpected external
destination.

Persistence-related evidence requires further validation.

SCOPE:
One endpoint confirmed; additional hosts being reviewed.

SEVERITY:
High

CONFIDENCE:
Medium

CONTAINMENT:
Recommended.

Part 59 — Assign Severity

Consider:

• execution status

• host criticality

• user privilege

• system changes

• persistence

• credential impact

• network activity

• multiple hosts

• security-control outcome

• potential data impact

Part 60 — Assign Confidence Separately

Example:

Severity:
Critical

Confidence:
Medium

may be appropriate when the potential business impact is very high but the available telemetry is incomplete.

Part 61 — Determine Containment Requirements

Potential actions may include:

• isolate endpoint

• terminate malicious process

• quarantine malicious file

• block domain/IP/hash

• disable affected account

• revoke sessions

• preserve endpoint evidence

• increase monitoring

Do not perform these actions unless the lab explicitly authorizes them.

Part 62 — Build the Containment Decision Matrix

Action	Required	Reason	Business Impact	Approval
Endpoint isolation
Process termination
File quarantine
IOC blocking
Credential reset

Part 63 — Prioritize Evidence Preservation

Where practical:

Preserve → Contain → Investigate Further

But active threats may require immediate containment.

Document the reason for the sequence chosen.

Part 64 — Determine Escalation

Escalate when:

• malware execution confirmed

• suspicious child processes observed

• external communication observed

• persistence suspected

• privileged user involved

• multiple endpoints affected

• credential exposure suspected

• containment is required

• sensitive host involved

Part 65 — Create the Escalation Package

ESCALATION SUMMARY

Case ID:

Host:

User:

Endpoint Criticality:

Alert:

Detection:

Execution Status:

Primary Process:

Parent Process:

Child Processes:

File Hash:

System Changes:

Network Destinations:

Persistence:

Credential Risk:

Other Affected Hosts:

Known Impact:

Severity:

Confidence:

Containment Recommended:

Evidence References:

Next Investigation Step:

Part 66 — Build the Endpoint Evidence Register

Evidence ID	Source	Description
EV-END-01	EDR	Original alert
EV-END-02	Endpoint	File metadata
EV-END-03	Endpoint	Process creation
EV-END-04	Endpoint	Process tree
EV-END-05	DNS	Domain activity
EV-END-06	Firewall/Proxy	Network connection
EV-END-07	Email	Delivery/source evidence
EV-END-08	Identity	Related authentication

Part 67 — Build the Final Endpoint Investigation Register

CASE ID:

HOST:

USER:

HOST CRITICALITY:

ALERT:

FILE:

HASH:

FILE SOURCE:

EXECUTION STATUS:

PRIMARY PROCESS:

PARENT PROCESS:

CHILD PROCESSES:

COMMAND LINE:

FILES CREATED:

SYSTEM CHANGES:

PERSISTENCE:

DNS ACTIVITY:

NETWORK ACTIVITY:

SECURITY CONTROL ACTION:

OTHER HOSTS:

OTHER USERS:

EMAIL CORRELATION:

IDENTITY CORRELATION:

TELEMETRY GAPS:

POSITIVE CONTROLS:

DISPOSITION:

SEVERITY:

CONFIDENCE:

PRIORITY:

KNOWN IMPACT:

ESCALATION:

CONTAINMENT:

REMAINING QUESTIONS:

Part 68 — Mission Challenge

Complete:

LAB INFORMATION

Lab:
Malware & Endpoint Investigation

Case ID:

Analyst:

Date:


INITIAL ALERT

Alert ID:

Detection:

Host:

User:

File:

Path:

Severity:

Action:


HOST CONTEXT

Hostname:

IP:

Role:

Criticality:

Owner:

Endpoint Protection:


USER CONTEXT

User:

Role:

Privileged:

Expected Host:

Related Phishing Case:


FILE ANALYSIS

Filename:

Path:

Size:

Hash:

Type:

Source:

Downloaded:

Quarantined:

Malicious Classification:


EXECUTION

Executed:
Yes / No / Unknown

Execution Time:

Process:

Parent:

Command Line:

Blocked:

Terminated:


PROCESS TREE

Parent:

Primary Process:

Child 01:

Child 02:

Child 03:

Assessment:


FILE / SYSTEM CHANGES

Files Created:

Files Modified:

Registry/System Changes:

Unexpected Changes:


PERSISTENCE

Scheduled Task:

Service:

Startup Entry:

Other:

Persistence Confirmed:
Yes / No / Unknown


NETWORK

DNS Queries:

Destinations:

Ports:

Protocols:

Proxy Activity:

Firewall Activity:

Blocked / Allowed:


CONTROL OUTCOME

Detected:

Execution Prevented:

Process Terminated:

File Quarantined:

Network Blocked:

Endpoint Isolated:


IOC CORRELATION

Hash on Other Hosts:

Domain on Other Hosts:

IP on Other Hosts:

URL on Other Hosts:


EMAIL CORRELATION

Related Email:

Sender:

Attachment/URL Match:

Recipient:

Timeline Match:


IDENTITY CORRELATION

Unexpected Authentication:

MFA Events:

Credential Risk:


SCOPE

Affected Hosts:

Affected Users:

Executed On:

Network Communications:

Potential Credential Exposure:


TELEMETRY GAPS

Gap 01:

Impact:

Gap 02:

Impact:


FINAL ASSESSMENT

Disposition:

Execution Status:

Endpoint Compromise:
Confirmed / Potential / Not Observed

Severity:

Confidence:

Priority:

Known Impact:

Escalation:
Yes / No

Containment Recommended:
Yes / No

Remaining Questions:

Ready for Network Security Alert Investigation:
Yes / No

Part 69 — What Not to Do

Do not:

Execute suspicious files

Disable security software

Run unknown binaries

Open suspicious attachments normally

Upload sensitive files to unapproved public services

Modify suspicious files

Delete original evidence

Remove artifacts before documenting them

Assume detection equals execution

Assume execution equals full compromise

Assume child process equals malicious behavior

Assume network connection equals exfiltration

Assume scheduled task equals persistence

Assume new service equals persistence

Assume hash match means every host executed the file

Reset accounts without authorization

Isolate business-critical systems without approval

Terminate production processes without authorization

Search unrelated user data

Create malware for the exercise

Attempt to reproduce malicious behavior

The professional rule is:

Investigate the malware’s observed behavior without reproducing the malware’s behavior yourself.

Troubleshooting

EDR Says Malware but No Process Exists

The file may have been blocked before execution.

Check:

• process creation

• control action

• file quarantine

• event timing

Process Exists but Command Line Is Missing

Document the telemetry gap.

Do not invent arguments.

Hash Has No Reputation

Unknown reputation does not mean benign.

Use local behavior and evidence.

File Was Downloaded but User Says They Never Opened It

Check execution telemetry.

User statements are useful context, but execution evidence is stronger.

Network Connection Is Present

Determine:

• which process generated it

• whether it was allowed

• whether data transfer is evidenced

Do not call it exfiltration automatically.

EDR Automatically Isolated the Host

Document the containment as a positive control and continue scoping.

Same Hash Exists on Multiple Hosts

Determine execution separately for each endpoint.

Evidence Requirements

Capture:

Evidence 01

Original endpoint alert.

Evidence 02

Case scope.

Evidence 03

Host Profile.

Evidence 04

User Profile.

Evidence 05

File Delivery Profile.

Evidence 06

File metadata.

Evidence 07

File hash.

Evidence 08

Execution status.

Evidence 09

Execution Register.

Evidence 10

Parent process.

Evidence 11

Process tree.

Evidence 12

Command-line evidence.

Evidence 13

Child-process activity.

Evidence 14

File-System Change Register.

Evidence 15

System Change Register.

Evidence 16

Persistence Register.

Evidence 17

Network Connection Register.

Evidence 18

DNS correlation.

Evidence 19

Proxy/web correlation.

Evidence 20

Security-Control Outcome.

Evidence 21

Endpoint Security Control Matrix.

Evidence 22

Hash search across endpoints.

Evidence 23

IOC Correlation Matrix.

Evidence 24

Email-to-Endpoint Correlation.

Evidence 25

Identity correlation.

Evidence 26

Privilege Context Register.

Evidence 27

Endpoint Impact Matrix.

Evidence 28

Host Scope.

Evidence 29

User Scope.

Evidence 30

Process Scope.

Evidence 31

IOC Scope.

Evidence 32

Master Endpoint Timeline.

Evidence 33

Hypothesis Matrix.

Evidence 34

Containment Decision Matrix.

Evidence 35

Escalation Package.

Evidence 36

Endpoint Evidence Register.

Evidence 37

Final Endpoint Investigation Register.

Evidence 38

Mission Challenge worksheet.

Mission Deliverables

Complete:

• endpoint case opened

• original alert preserved

• host context established

• user context established

• file source investigated

• file metadata documented

• hash documented

• execution status determined

• process creation analyzed

• parent process identified

• child processes analyzed

• command-line evidence reviewed

• file-system changes reviewed

• system changes reviewed

• persistence indicators assessed

• DNS evidence correlated

• network evidence correlated

• proxy evidence correlated

• security-control outcome documented

• positive controls documented

• hash searched across other endpoints

• other indicators correlated

• phishing evidence correlated where applicable

• identity activity correlated where applicable

• privilege context determined

• endpoint impact assessed

• host scope determined

• user scope determined

• process scope determined

• IOC scope determined

• master timeline completed

• competing hypotheses evaluated

• disposition assigned

• severity assigned

• confidence assigned separately

• containment decision documented

• escalation decision documented

• final Endpoint Investigation Report completed

Lab Report Template

# Lab 07 — Malware & Endpoint Investigation

## Executive Summary

## Mission Objective

## Case Information

## Initial Endpoint Alert

## Investigation Scope

## Host Context

## User Context

## File Delivery Analysis

## File Metadata

## File Hash Analysis

## Execution Analysis

## Parent-Child Process Analysis

## Process Tree

## Command-Line Analysis

## File-System Changes

## System Changes

## Persistence Analysis

## DNS Correlation

## Network Correlation

## Proxy / Web Correlation

## Security-Control Outcome

## Email Correlation

## Identity Correlation

## Privilege Context

## IOC Correlation

## Endpoint Impact

## Host Scope

## User Scope

## Process Scope

## IOC Scope

## Master Timeline

## Hypothesis Analysis

## Final Disposition

## Severity

## Confidence

## Positive Security Controls

## Containment Recommendation

## Escalation Decision

## Evidence Register

## Remaining Questions

## Limitations

## Conclusion

Knowledge Check

Question 1 — Does an endpoint malware alert prove the file executed?

No.

The security product may have detected and blocked it before execution.

Question 2 — Does a file hash match prove endpoint compromise?

No.

It proves the file content matches the referenced hash. Execution and impact require separate evidence.

Question 3 — Why analyze the parent process?

It helps determine how the suspicious process was launched and provides execution context.

Question 4 — Does PowerShell as a child process automatically prove malicious activity?

No.

Context, command line, user, timing, and related behavior must be analyzed.

Question 5 — Does file creation prove execution?

No.

A file can exist without ever being run.

Question 6 — Does an outbound connection prove data exfiltration?

No.

Connection and confirmed data transfer are separate findings.

Question 7 — Does a scheduled task automatically prove persistence?

No.

Scheduled tasks are commonly used for legitimate operations.

Question 8 — Why search the same hash across other endpoints?

To determine whether the file is isolated to one endpoint or appears elsewhere.

Question 9 — Why correlate endpoint evidence with phishing evidence?

It can establish whether an email delivery or user interaction preceded the endpoint alert.

Question 10 — What is the central question of this lab?

“Was malicious code actually executed on the endpoint, what did it do, how far did the activity spread, and what evidence supports containment or escalation?”

Skills Achieved

After completing this lab, you should understand:

• EDR alert investigation

• malware-detection analysis

• file metadata analysis

• hash correlation

• execution validation

• process-tree analysis

• parent-child relationships

• command-line analysis

• file-system change investigation

• system-change investigation

• persistence analysis

• DNS correlation

• endpoint network investigation

• IOC correlation

• phishing-to-endpoint correlation

• identity correlation

• privilege-context analysis

• endpoint impact determination

• incident scoping

• containment planning

• SOC escalation

• endpoint incident reporting

Professional Takeaway

A weak endpoint investigation looks like:

Malware Alert
     ↓
Malicious Hash
     ↓
Host Compromised

A professional endpoint investigation looks like:

Endpoint Alert
      ↓
Identify Host + User
      ↓
Identify File
      ↓
Determine Execution
      ↓
Parent / Child Processes
      ↓
File + System Changes
      ↓
Network Activity
      ↓
Persistence Evidence
      ↓
Correlate Email + Identity
      ↓
Search Other Endpoints
      ↓
Build Timeline
      ↓
Determine Scope + Impact
      ↓
Contain / Escalate / Report

Always distinguish:

Malware Detection
       ≠
Malware Execution

Malware Execution
       ≠
Complete Host Compromise

Hash Match
       ≠
Execution

File Downloaded
       ≠
File Executed

Child Process
       ≠
Malicious Child Process

Network Connection
       ≠
Data Exfiltration

Scheduled Task
       ≠
Malicious Persistence

New Service
       ≠
Malicious Persistence

One Affected Endpoint
       ≠
Enterprise-Wide Compromise

The strongest endpoint analyst does not stop after asking:

“What did the antivirus detect?”

They continue until they can answer:

“Did it execute, what process chain followed, what changed on the system, what communications occurred, what other systems show the same indicators, and what evidence justifies containment?”

What’s Next?

➡️ Lab 08 — Network Security Alert Investigation

In the next lab, you will shift from endpoint telemetry to network detection and analyze:

• source and destination IP addresses

• source and destination ports

• protocols

• network direction

• IDS/IPS alerts

• firewall actions

• connection frequency

• asset ownership

• service context

• related authentication

• endpoint correlation

• allowed vs blocked traffic

• repeated communications

• network scope

• alert confidence

• escalation decisions

The methodology becomes:

Network Alert → Source → Destination → Service → Direction → Context → Correlation → Scope → Disposition

The central question will be:

“What network activity triggered the alert, was the communication actually allowed or successful, and does the correlated evidence support expected traffic, suspicious behavior, or a security incident?”