<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-malware-alert-analysis
description: >-
  Analyze malware alerts from EDR and SIEM platforms including static indicator
  assessment, behavioral analysis, sandbox result interpretation, IOC extraction,
  threat intelligence correlation, and containment decision-making across
  CrowdStrike, Defender, and SentinelOne alerts.
domain: cybersecurity
subdomain: soc-operations
tags:
  - malware-analysis
  - edr
  - soc
  - ioc
  - sandbox
  - crowdstrike
  - defender
  - sentinelone
  - threat-intel
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1587.001"]
---

# Performing Malware Alert Analysis

## Overview

Malware alert analysis in the SOC context focuses on rapid triage of EDR and
antivirus alerts to determine severity, scope, and required response actions.
This is not full reverse engineering — it is operational analysis to make
fast containment decisions using available tools and threat intelligence.

## Prerequisites

| Requirement | Purpose |
|---|---|
| EDR console (CrowdStrike/Defender/S1) | Alert context and host data |
| Sandbox access (ANY.RUN/Joe/VT) | Behavioral detonation |
| VirusTotal / MalwareBazaar | Hash reputation |
| SIEM access | Lateral movement correlation |

## Key Concepts

### Malware Alert Triage Decision Tree

```
MALWARE ALERT RECEIVED
├── Check EDR verdict
│   ├── Blocked/Quarantined → Lower urgency, verify cleanup
│   └── Detected/Not blocked → HIGH urgency, containment needed
│
├── Identify the file
│   ├── File hash (SHA256) → VT/MalwareBazaar lookup
│   ├── File name/path → Expected software or suspicious location?
│   ├── Signer → Valid code signing or unsigned?
│   └── File type → Executable, script, document with macro?
│
├── Check execution context
│   ├── Parent process → How was it launched?
│   ├── User context → Admin or standard user?
│   ├── Process tree → What child processes spawned?
│   └── Network connections → C2 callback observed?
│
├── Assess scope
│   ├── Single host or multiple?
│   ├── Lateral movement indicators?
│   └── Data access or exfiltration observed?
│
└── Decide action
    ├── CONTAIN: Isolate host, block IOCs
    ├── MONITOR: Watchlist, increase logging
    └── CLOSE: Known benign, update allowlist
```

### EDR Investigation Queries

**CrowdStrike Falcon — Process Tree:**
```
event_simpleName=ProcessRollup2
| search SHA256Hash="$hash$"
| table timestamp, ComputerName, UserName, ImageFileName,
    ParentBaseFileName, CommandLine
| sort timestamp
```

**Microsoft Defender — Device Timeline:**
```kql
DeviceProcessEvents
| where SHA256 == "$hash$"
| project Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp asc

DeviceNetworkEvents
| where InitiatingProcessSHA256 == "$hash$"
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl
```

**Splunk — Malware Spread Assessment:**
```spl
-- Find all hosts with same hash
index=edr file_hash="$sha256$"
| stats count, earliest(_time) as first_seen,
    latest(_time) as last_seen,
    values(action) as actions by host
| sort first_seen

-- Process tree from Sysmon
index=sysmon EventCode=1
  (Hashes="*$sha256$*" OR ParentImage="*$malware_name$*")
| table _time, Computer, User, ParentImage, Image, CommandLine
| sort _time

-- Network IOCs from malware execution
index=proxy OR index=dns
  src_ip IN ($infected_hosts$)
| where _time > relative_time(now(), "-24h")
| stats count by dest, dest_port, query
| sort -count
```

### Sandbox Result Interpretation

```
SANDBOX REPORT ANALYSIS:
├── Verdict
│   ├── Malicious score / confidence
│   └── Malware family classification
│
├── Behavioral Indicators
│   ├── File system: drops, modifications, encryption
│   ├── Registry: persistence keys, configuration
│   ├── Process: injection, hollowing, spawned processes
│   ├── Network: C2 callbacks, DNS queries, downloads
│   └── Evasion: sandbox detection, time delays, VM checks
│
├── IOC Extraction
│   ├── File hashes (MD5, SHA1, SHA256)
│   ├── Dropped file hashes
│   ├── C2 IP addresses and domains
│   ├── DNS queries
│   ├── Registry keys modified
│   └── Mutexes created
│
└── ATT&CK Mapping
    ├── Execution technique
    ├── Persistence mechanism
    ├── C2 protocol
    └── Impact/objective
```

### IOC Blocking Template

```yaml
containment_actions:
  network:
    - type: firewall_block
      iocs: ["203.0.113.50", "198.51.100.25"]
      direction: both
    - type: dns_sinkhole
      domains: ["evil-c2.example.com", "update.malware.xyz"]

  endpoint:
    - type: hash_block
      hashes: ["a1b2c3d4..."]
      platform: crowdstrike_ioc
    - type: host_isolation
      hosts: ["WS023", "WS024"]
      duration_hours: 24

  email:
    - type: sender_block
      addresses: ["attacker@phishing.com"]
    - type: attachment_quarantine
      hashes: ["a1b2c3d4..."]
```

## Workflow

1. **Alert** — Receive and prioritize malware alert from EDR/AV
2. **Identify** — Collect file hash, name, path, and signer
3. **Reputation** — Check hash against VT, MalwareBazaar, internal TI
4. **Context** — Review process tree, user, and execution context
5. **Scope** — Search for same hash/behavior across environment
6. **Detonate** — Submit to sandbox if unknown (safely)
7. **Decide** — Contain, monitor, or close based on findings
8. **Block** — Push IOCs to perimeter and endpoint controls
9. **Document** — Record findings, IOCs, and actions in case

## Detection

```yaml
title: Malware Alert Analysis Detection
id: 37202bf4-ecc2-4353-9184-cfa00cc493e6
status: experimental
description: Detects suspicious activity related to performing malware alert analysis techniques in soc operations context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*malware*"
  condition: selection
level: medium
tags:
  - attack.t1587.001
  - attack.defense_evasion
falsepositives:
  - SOAR platform executing automated response playbooks
```

## Verification

| Check | Method |
|---|---|
| Hash reputation checked | VT/MB query log |
| Process tree reviewed | EDR console screenshot |
| Scope assessed (lateral spread) | SIEM environment-wide hash search |
| IOCs extracted and blocked | Blocklist entries verified |
| Containment action executed | EDR isolation status confirmed |
