<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-malware-alert-triage
description: >-
  Malware-specific alert triage procedures for SOC analysts including hash
  reputation analysis, sandbox detonation workflow, behavioral IOC extraction,
  infection scope assessment, containment decision trees, and EDR-integrated
  response across CrowdStrike, Microsoft Defender, and SentinelOne.
domain: cybersecurity
subdomain: soc-operations
tags:
  - malware-triage
  - soc
  - edr
  - sandbox
  - hash-analysis
  - crowdstrike
  - defender
  - sentinelone
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1587.001"]
---

# Performing Malware Alert Triage

## Overview

Malware alerts require specialized triage that combines static indicator
analysis (hash reputation, file metadata) with behavioral assessment
(process tree, network connections, persistence mechanisms). Effective
malware triage determines infection scope, identifies the malware family,
and initiates appropriate containment before lateral spread.

## Prerequisites

| Requirement | Purpose |
|---|---|
| EDR platform (CrowdStrike/Defender/S1) | Detection and response |
| Sandbox (Any.Run/Joe Sandbox/Hybrid Analysis) | Safe detonation |
| VirusTotal / YARA rules | Static analysis |
| Network monitoring | C2 traffic detection |

## Key Concepts

### Malware Triage Decision Tree

```
MALWARE ALERT TRIAGE:
├── 1. Hash Reputation Check
│   ├── Known malicious → Skip to Containment
│   ├── Known clean → Verify detection logic, likely FP
│   └── Unknown → Proceed to behavioral analysis
├── 2. Behavioral Analysis
│   ├── Process tree — parent/child suspicious?
│   ├── Network connections — C2 indicators?
│   ├── File system changes — persistence mechanisms?
│   ├── Registry modifications — autorun entries?
│   └── Privilege escalation attempts?
├── 3. Scope Assessment
│   ├── How many hosts have the same hash?
│   ├── What user(s) executed the file?
│   ├── Lateral movement indicators?
│   └── Data staging or exfiltration signs?
├── 4. Containment Decision
│   ├── Isolate host — confirmed execution + C2
│   ├── Block hash — prevent further execution
│   ├── Block C2 domains/IPs — cut communications
│   └── Disable compromised accounts
└── 5. Evidence Collection
    ├── Memory dump (before reboot)
    ├── File sample acquisition
    ├── Process tree snapshot
    └── Network connection log
```

### Hash Reputation Lookup

```bash
# VirusTotal hash lookup
curl -s -H "x-apikey: ${VT_API_KEY}" \
  "https://www.virustotal.com/api/v3/files/${SHA256}" \
  | jq '{
    malicious: .data.attributes.last_analysis_stats.malicious,
    name: .data.attributes.meaningful_name,
    type: .data.attributes.type_description,
    first_seen: .data.attributes.first_submission_date,
    tags: .data.attributes.tags
  }'

# MalwareBazaar hash lookup
curl -s -X POST "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_info&hash=${SHA256}" \
  | jq '.data[0] | {signature, file_type, delivery_method, tags}'
```

### EDR Investigation Queries

```
# CrowdStrike Falcon — Process tree for detection
GET /detects/queries/detects/v1?filter=device.hostname:'$HOST$'

# CrowdStrike — IOC search across fleet
POST /indicators/entities/iocs/v1
{"type": "sha256", "value": "$HASH$", "action": "detect"}

# Microsoft Defender — Device timeline
GET /api/machines/$MACHINE_ID$/timeline?$filter=eventTime gt $START$

# SentinelOne — Deep Visibility query
{"query": "ObjectHash = '$HASH$'", "fromDate": "$START$", "toDate": "$END$"}
```

### Splunk Malware Triage Queries

```spl
-- Find all hosts with specific file hash
index=sysmon EventCode=1 Hashes="*${SHA256}*"
| stats count, values(Computer) as hosts, values(User) as users
    by Image, ParentImage

-- Process tree reconstruction
index=sysmon EventCode=1 Computer="$HOST$"
| where ParentProcessId="$PID$" OR ProcessId="$PID$"
| table _time, ParentImage, Image, CommandLine, User
| sort _time

-- Network connections from suspicious process
index=sysmon EventCode=3 Computer="$HOST$" Image="$MALWARE_PATH$"
| table _time, DestinationIp, DestinationPort, DestinationHostname
| sort _time
```

### Sentinel KQL Malware Triage

```kql
// File hash prevalence across organization
DeviceFileEvents
| where SHA256 == "$HASH$"
| summarize Hosts=dcount(DeviceName), FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp) by FileName, FolderPath

// Process tree for infected host
DeviceProcessEvents
| where DeviceName == "$HOST$" AND Timestamp > ago(24h)
| where InitiatingProcessSHA256 == "$HASH$" OR SHA256 == "$HASH$"
| project Timestamp, FileName, ProcessCommandLine,
    InitiatingProcessFileName, AccountName
```

## Workflow

1. **Identify** — Extract file hash, path, and process context from alert
2. **Reputation** — Check hash against VT, MalwareBazaar, internal intel
3. **Analyze** — Review process tree, network connections, file changes
4. **Scope** — Search fleet for same hash and related IOCs
5. **Contain** — Isolate hosts, block hash, sever C2 communications
6. **Collect** — Preserve memory dump, file sample, and logs
7. **Document** — Record malware family, IOCs, and remediation steps

## Detection

```yaml
title: Malware Alert Triage Detection
id: 20b656bd-1c6c-405a-a70b-3d583e623bf7
status: experimental
description: Detects suspicious activity related to performing malware alert triage techniques in soc operations context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*malware*"
  condition: selection
level: medium
tags:
  - attack.t1587.001
  - attack.defense_evasion
falsepositives:
  - SOAR platform executing automated response playbooks
```

## Verification

| Check | Method |
|---|---|
| Hash reputation checked | VT/MalwareBazaar results documented |
| Process tree reviewed | Parent-child chain validates execution path |
| Scope assessed | Fleet-wide hash search completed |
| C2 infrastructure identified | Network IOCs extracted and blocked |
| Evidence preserved | Memory dump and file sample collected before cleanup |
