---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
This document outlines the Security Operations Center (SOC) response process for handling malware detection alerts on an endpoint. The goal is to ensure efficient investigation, containment, eradication, and documentation of malware incidents while minimizing impact on business operations.

This process enables SOC Analysts to:

- Determine the validity of a malware alert (true positive or false positive).
- Assess the impact and scope of the infection.
- Identify the infection source and propagation method.
- Contain, remediate, and escalate as necessary.
- Document findings and improve threat intelligence and security defenses.

## Scope
This process applies to all SOC personnel responsible for investigating and responding to malware detections on endpoints, including but not limited to:

- Workstations and laptops
- Servers
- Virtual Machines (VMs)
- Cloud-hosted workloads
- Network-connected devices (e.g., IoT, printers, specialized hardware)

This process is applicable to all malware-related alerts, including:

- File-based malware (Trojans, ransomware, spyware, worms)
- Memory-based malware (fileless attacks)
- Credential theft tools
- Persistence mechanisms and backdoors
- Active attacker toolsets and remote access trojans (RATs)

## Roles and Responsibilities

| Role                                      | Responsibility                                                                                                                                             |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst                               | Investigates malware alerts, determines impact, contains and eradicates threats, and documents findings.                                                   |
| SOC Manager                               | Oversees malware incident response, ensures proper escalation, and reviews process adherence.Collects and presents metrics relevant to malware alerts. |
| IT Teams                                  | Assists in endpoint remediation, patching, and blocking malicious sources.                                                                                 |
| Cyber Threat Intelligence (CTI) Team      | Analyzes malware indicators and updates threat intelligence databases.                                                                                     |
| Malware Analysis Team                     | Conducts in-depth forensic analysis of collected malware samples.                                                                                          |
| Data Privacy Team                         | Assesses and responds to potential data breaches or exfiltration.                                                                                          |
| Identity and Access Management (IAM) Team | Resets compromised credentials and enforces security measures.                                                                                             |
| Vulnerability Management Team             | Patching any exploited vulnerabilities identified in investigations.                                                                                       |
## Process Steps
### Step 1: Ticket Creation and Alert Validation

1. Create a ticket in the incident tracking system to log all findings, actions, and outcomes.
2. Review the malware alert details from SIEM, EDR, or antivirus tools, including:
    - Malware name or classification (if known).
    - File path or memory location.
    - Process ID (if running).
    - Execution timestamp.
    - Hashes of files.
    - Detection mechanism (signature-based, behavior-based, heuristic, etc.).
3. Determine if the alert is a false positive by:
    - Checking past detections and analyst notes.
    - Reviewing vendor documentation and known benign applications.
    - Querying threat intelligence sources for false positive reports.
    - Comparing hash values to threat intelligence and other sources.
    - Process heritage or association for unusual indicators (such as office documents spawning interactive shells or web connections, etc.)

### Step 2: Impact Assessment and Malware Behavior Analysis

If the alert is a true positive, assess the impact of the infection:

4. Locate the malware on the filesystem and determine:
    - File path and associated process (if running).
    - User account or privileges used to execute the malware.
    - Whether the file is static (not executed) or active in memory.
5. Check antivirus/EDR logs to determine:
    - If the malware was blocked, quarantined, or fully executed.
    - If any persistence mechanisms were detected.
    - If other hosts in the environment have reported similar detections.
6. Assess endpoint type and criticality:
    - Is the infected device a user workstation, server, or domain controller?
    - Does it have access to sensitive data, critical infrastructure, or privileged accounts?
	    - Is the endpoint in any security sensitive zone (production, R&D, manufacturing, etc.)?

### Step 3: Identify Infection Source and Attack Vector

Determine how the malware was introduced:

1. Check email logs for:
    - Malicious attachments or phishing links.
    - Any similar reports from other users.
2. Review web proxy logs for:
    - Downloads from suspicious websites.
    - User browsing history at the time of infection.
3. Investigate USB/removable media logs for:
    - Unauthorized devices.
    - Any recent file transfers.
4. Check DNS and network traffic logs for:
    - Connections to known malicious IPs/domains.
    - Signs of command-and-control (C2) communication.
5. Look for vulnerability exploitation
	* If there are signs that a vulnerability present on the endpoint was linked to the delivery of malware alert the Vulnerability Management team to prioritize patching.

### Step 4: Escalation and Containment Actions

If malware is active, spreading, or linked to an attack:

1. Immediately escalate to SOC leadership and the Incident Response Team (IRT).
2. If malware is part of hacking tools or an active attacker campaign:
    - Notify Threat Intelligence (CTI) team to investigate broader threat implications.
    - Escalate to IT Operations to block malicious files and processes across all endpoints.
3. Contain the infection:
    - Isolate the endpoint from the network if necessary.
	    - Conduct a [[PRO - Business Impact Assessment]] to ensure no adverse result of this activity.
	    - Seek permission from the SOC Director prior to containment.
    - Disable the user account if credentials were compromised.
	    - Inform the SOC Director if the affected user is a VIP or if loss of user access could be business impacting.
	    - Follow [[SOP - Credential Reset]]

### Step 5: Eradication and Remediation

1. Coordinate with IT teams to:
    - Remove/quarantine the malware.
    - Apply security patches and updates.
    - Block the infection source (email, website, external device, etc.).
2. If malware cannot be contained or removed, recommend:
    - Rebuilding the endpoint and restoring from a known clean state.

### Step 6: Threat Intelligence and Security Enhancement

1. Document all malware indicators, including:
    - File/process names.
    - File hashes (MD5, SHA-1, SHA-256).
    - C2 server IPs/domains.
2. Submit indicators of compromise (IOCs) to the Cyber Threat Intelligence (CTI) team for:
    - Threat enrichment.
    - Inclusion in SIEM detection rules.
    - Distribution to other security teams.

### Step 7: Investigation into Additional Exposure

1. Determine if other users or endpoints might have encountered the same malware:
    - Run organization-wide searches for IOCs.
    - Notify IT to scan other endpoints for similar detections.
2. Submit tickets for:
    - Blocking malicious domains, email addresses, or files.
    - Investigating potential lateral movement or secondary infections.

### Step 8: Post-Incident Actions and Documentation

3. Review and update all tickets with:
    - Findings from the investigation.
    - Containment and remediation actions taken.
    - Indicators submitted for threat intelligence tracking.
4. Retain evidence in accordance with evidence retention policies.
5. Conduct a post-incident review to:
    - Identify gaps in security controls.
    - Improve detection rules to prevent similar infections.
    - Adjust response procedures as necessary.
