1

My company currently gets malware alerts from several source's i.e. Symantec Endpoint Protection and FireEye. When these alerts are triggered, a manual process of logging onto the user's machine is started with the aim of finding any malware etc. that the security protection may have missed. The process of the analysis is pretty hit and miss. Powereraser, Windows SysInternals, route around.

As above I looking for some guidance into how a standard manual investigation could be preformed.

1

It will depend on what your end goal is. For my part, I create a process by which I can rapidly (within 15 minutes) wipe and reload a drive image on a machine. I take an image of the infected machine first then, wipe, reload, and get the user back up and running.

I load the infected image in a protected environment and look for network activity and changed operating system files. I also research the threat itself to see what kinds of things that malware is supposed to do and use that as a means to start further investigation.

1

If you are looking to do a more hands on manual analysis of malicious software, it can involve a variety of tasks, some simpler than others. These efforts can be grouped into stages based on the nature of the associated malware analysis techniques. This cannot always be observed, but in many scenarios you have an opportunity to perform manual investigation

You can start with fully automated analysis which will be the easiest. This is what is normally done by using various tools to analyze the situation and then provide the best method of resolving the issue. It will resolve the issue, but leaves little room for more attention or use of anything more analytically ideal.

When taking a closer look at the suspicious file might proceed by examining its static properties. Such details can be obtained relatively quickly, because they don’t involve running the potentially-malicious program. Static properties include the strings embedded into the file, header details, hashes, embedded resources, packer signatures, meta data such as the creation date, etc.

Looking at static properties can sometimes be sufficient for defining basic indicators of compromise. This process also helps determine whether the analyst should take closer look at the specimen using more comprehensive techniques and where to focus the subsequent steps. Analyzing static properties is useful as part of the incident triage effort.

A behavior analysis can also help when observing, Behavioral analysis involves examining how sample runs in the lab to understand its registry, file system, process and network activities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.