Tools · Incident response playbooks · 15 / 20
Playbook: malware alert on a workstation, from triage to reimage
Handle an EDR malware alert: decide whether it was blocked or ran, contain the host, collect evidence, check for spread, and decide between cleanup and reimaging.
Blocked or executed?
The first question is whether the malware only landed or actually ran. A quarantine of a downloaded file that never executed is usually low severity. Evidence of execution, such as child processes, network connections, persistence creation, or credential access, raises it. Look at the process tree and the timeline around the alert.
Contain and collect
If it ran, isolate the host with EDR network containment. Collect a triage package: process list, autoruns, recent files, event logs, and memory if the case is serious. Get the file hash and look it up in threat intelligence without uploading internal documents to public services.
Lab: use the EICAR test file
On a lab VM with Microsoft Defender or another antivirus, download the harmless EICAR test file, which every antivirus detects by design. Find the detection in the local event log (Defender Event ID 1116 and 1117) or EDR console, read the fields, and practice the containment and closure steps. EICAR is not malware; it exists to test detection pipelines.
# PowerShell on a lab VM
Invoke-WebRequest https://secure.eicar.org/eicar.com.txt -OutFile $env:TEMP\eicar.txt
Get-MpThreatDetection | Select-Object -First 5 InitialDetectionTime,ThreatID,ProcessName,Resources
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1116,1117} -MaxEvents 5 | Format-List TimeCreated,Id,MessageClean or reimage
Reimaging is the safer default when malware executed with administrative rights, established persistence, or when you cannot fully explain its behavior. Cleaning may be acceptable for a well-understood, low-privilege adware case. Before returning the device, reset credentials used on it, check for the same hash or behavior on other hosts, and document the root cause, such as a malicious download or an unpatched browser.
Diagram
Quarantined on download versus executed
Execution changes everything.
Process tree. No child processes
Network. No new connections
Action. Verify, close, educate user
Process tree. Spawned processes, persistence created
Network. Outbound to unknown host
Action. Isolate, collect, scope, reimage, reset credentials
Check yourself
1. What is the first question for a malware alert?
2. What is the EICAR file?
3. Malware ran as administrator and created a service. What is the safer remediation?