skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-malware-incident-response

Guides malware incident response from detection through containment, eradication, and recovery.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#edr#eradication#mitre att&ck#IOC extraction#malware response#endpoint remediation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill conducting-malware-incident-response
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-malware-incident-response
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/conducting-malware-incident-response
Command: npx skills add https://github.com/xalgord/xalgorix --skill conducting-malware-incident-response

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Responding to a malware infection requires coordinating detection validation, scoping, containment, analysis, eradication, and recovery across many endpoints, and missing a single persistence mechanism or secondary payload guarantees reinfection. This Skill provides a structured, end-to-end playbook so responders eradicate malware completely instead of triaging alerts piecemeal.

Core Features & Use Cases

  • Full Lifecycle Workflow: Six-step process covering detection confirmation, infection scoping, containment, sandbox analysis, eradication, and validated recovery with a 72-hour monitoring window.
  • IOC Extraction & ATT&CK Mapping: Identifies persistence mechanisms, C2 infrastructure, dropped files, and maps observed behaviors to MITRE ATT&CK techniques.
  • Anti-Pattern Guidance: Flags common mistakes such as eradicating before capturing memory, scoping by hash alone, and missing backup persistence mechanisms.
  • Use Case: An EDR alert fires on a Qakbot infection delivered via a phishing attachment. Follow the workflow to isolate hosts, quarantine the email, extract C2 indicators, remove all persistence, and produce a structured incident report.

Quick Start

Respond to the Qakbot infection detected on workstation WKSTN-087 by scoping affected endpoints, containing the hosts, and producing an eradication and recovery report.

Frequently Asked Questions about conducting-malware-incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I respond to a malware infection on an endpoint?▼

Confirm the detection by reviewing the EDR alert and process tree, then scope the infection across all endpoints, isolate affected hosts, analyze the sample in a sandbox, remove all artifacts and persistence mechanisms, and monitor for 72 hours after recovery.

How to remove malware persistence mechanisms from Windows?▼

Enumerate all persistence locations including scheduled tasks, registry Run keys, services, and WMI event subscriptions, then delete each one across every infected host. Verify removal by rescanning after a reboot, since malware often installs multiple backup persistence mechanisms.

What tools are needed for malware incident response?▼

The workflow uses an EDR platform like CrowdStrike or Microsoft Defender for containment, a sandbox such as ANY.RUN or Joe Sandbox for behavioral analysis, VirusTotal or MalwareBazaar for intelligence, and KAPE for forensic artifact collection.

Why does malware reinfect systems after cleanup?▼

Reinfection typically occurs when responders remove only the primary payload while missing secondary stages or backup persistence mechanisms like WMI subscriptions and extra scheduled tasks. Scoping by file hash alone also fails because hashes change per host; sweep on durable behavioral indicators instead.

When should I reimage an infected endpoint instead of cleaning it?▼

Reimage from a known-clean gold image when eradication confidence is low, such as when analysis is incomplete or the full set of dropped artifacts cannot be enumerated. Always capture a memory dump before reimaging to preserve fileless payloads and stolen credentials.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-indicators-of-compromise

Consolidate VirusTotal, AbuseIPDB, and MalwareBazaar results into a unified confidence score and disposition.

Community
Intermediate
defconxtdefconxt

Threat Intelligence

Profile threat actors and manage IOCs using the Diamond Model and Cyber Kill Chain.

Community
Advanced
YukiIto1999YukiIto1999

performing-endpoint-forensics-investigation

Identify and document endpoint compromises through Windows digital forensics investigations.

Community
Advanced
chicanoandres702chicanoandres702

malware-analyst

Analyze malware samples for triage, static and dynamic analysis, and IOC extraction.

Community
Advanced