How it works
Malware can steal, encrypt, spy, disrupt, or persist. Endpoint tools can quarantine files and create alerts, but humans still investigate scope.
Preserve logs, report through the approved process, isolate affected systems when needed, and avoid running suspicious files.
Common error
Quarantine is not the end of investigation. The question may ask what evidence to review next.
Worked example
An endpoint alert quarantines a suspicious attachment. Plan the next investigation.
Evidence
Alert: attachment quarantined
User report: attachment opened earlier
Outbound connection: recorded after openingQuarantine limits access to the identified file but does not establish the full scope. Preserve the alert, file information, process history, and related network evidence. Follow the incident plan for containment and assess whether other devices or accounts are affected.
Exercises
4.3.1
Why is deleting the alert and declaring the device clean a weak response?
Show solution
It discards useful evidence and ignores activity that may have occurred before quarantine. Investigate execution, persistence indicators, account use, and related devices as appropriate.
4.3.2
Name one containment action and one recovery check for an affected endpoint.
Show solution
Containment may include approved network isolation to limit further communication. Recovery should verify the corrected baseline, required application behavior, and absence of the investigated indicators under the incident plan.