Malware Response Playbook - Detection & Remediation Procedures | DADavisDesigns

1 Identification & Scoping

🚨 Initial Trigger: Use this phase when antivirus or EDR indicates suspicious activity.

✓ Verify the Alert: Confirm not False Positive. Check hash.
✓ Isolate Scope: Identify infected endpoints.
✓ Classify Threat: Ransomware, Trojan, or Adware?

2 Containment

Stop the spread immediately.

✓ Network Isolation: Disconnect but keep powered on (if possible).
✓ Block C2 Traffic: Block known Command & Control IPs.
✓ Disable Accounts: Reset passwords.

3 Eradication

✓ Re-Image: Wipe and re-image from gold image.
✓ Antivirus Removal: Full scan in Safe Mode if re-imaging not possible.
✓ Remove Persistence: Check Registry Run keys and Scheduled Tasks.
✓ Patch Vulnerabilities: Apply OS/App patches.

4 Recovery & Lessons Learned

✓ Restore Data: Restore from clean backups.
✓ Monitor: Watch for re-infection for 24-48 hours.
✓ Post-Incident Report: Document infection vector and update defenses.