Determining status of infected/affected computing resources
What next?
Examine inventory of affected devices and resources
Start forensics to see if there are signs of exfiltration
Look for anti-forensics measures
Look for any signs of credential harvesting and horizontal movement
Malware
Remember, some malware changes its characteristics from one device to the other
Look for patterns of behavior instead of focusing too much on certain ports, executable names, etc.
Be sure to revisit any threat intel concerning any discovered malware
Some behavior may not be apparent early on
Group devices
Make sure you separate devices that are known to be compromised versus the ones likely to have been compromised
Prioritize known devices and record their state in detail
Treat cloudbased devices as you would others
Contained
Continue all containment activities until all known compromised devices are contained
Continue to move likely candidates from "likely" to either "compromised/infected" or "not compromised/infected"
Once all devices or segments have been categorized and all compromised devices meet the organization's definition of containment, that phase is over
Remember, this is not a guarantee
Last updated