Malware

Malware detection playbook

Find out whether harmful code actually ran, and how far it got.

Use this when: An antivirus or EDR alert, a suspicious file hash, or an Office program starting a script.

Steps

0 of 6 ticked

1. Read the detection nameIs it a real malware family, a generic heuristic, or a harmless test file such as EICAR?
2. Find out how the file arrivedEmail attachment, download, USB drive, or created by a user? The first appearance tells you where to look next.
3. Did it run?Look at the process tree. A document starting PowerShell, or an unsigned program running from Downloads, means it executed.
4. Check the network afterwardsNew outbound connections right after execution often mean it is downloading more malware or contacting its controller.
5. Check the hash and spreadLook the hash up, and search for the same file or detection on other machines.
6. ContainIf it ran, isolate the machine, then collect details for the next team. If it was quarantined and never ran, note the evidence and close.

EDR / antivirus consoleProcess treeIntel lookup

Found something confusing or unrealistic?