Chapter 75 — Digital forensics and malware triage
In one sentence
Forensics is disciplined evidence handling; malware triage is answering "what does this thing do and where else did it run?" fast enough to contain impact.
First principles
- Preserve evidence before changing state when possible.
- Record timestamps in UTC.
- Hash collected files.
- Keep chain-of-custody notes for legal/regulatory cases.
- Separate triage from deep reverse engineering.
Host triage checklist
1. Isolate or contain according to IR policy.
2. Capture volatile evidence if feasible.
3. Record logged-in users, processes, network connections, scheduled tasks.
4. Collect suspicious binaries/scripts and hashes.
5. Pull EDR timeline for process ancestry.
6. Identify persistence.
7. Search enterprise-wide for hashes, paths, command lines, domains, IPs.
Malware triage questions
- How did it execute?
- What process spawned it?
- What files/registry/plist/systemd units did it create?
- What network destinations did it contact?
- What credentials or data could it access?
- Is it commodity malware, dual-use tooling, or custom?
Safe handling
Use an isolated lab VM with no shared clipboard/folders unless required, controlled networking, snapshots, and known-good tooling. Do not upload sensitive proprietary samples to public multi-scanner services without policy approval; doing so may disclose incident details.
Common mistakes
- Rebooting before collecting volatile evidence.
- Focusing on the malware file while missing stolen credentials.
- Failing to search for lateral movement.
- Treating "EDR quarantined it" as incident closure.