Incident Response & Malware Analysis
📝 Concept Note — DFIR Unit V | Source: MCA Sem III Syllabus
Incident Response Lifecycle — NIST SP 800-61
Phase 1: Preparation
- Build IR team, define roles and responsibilities
- Deploy detection tools (SIEM, EDR, IDS)
- Create IR playbooks for common scenarios
- Conduct tabletop exercises and drills
- Maintain contact lists (legal, management, law enforcement)
- Prepare forensic workstations and jump bags
Phase 2: Detection & Analysis
- Monitor alerts from SIEM, IDS, EDR, user reports
- Triage alerts: true positive vs false positive
- Determine scope: which systems, which data
- Classify severity (Critical/High/Medium/Low)
- Preserve volatile evidence immediately
Phase 3: Containment
- Short-term: Isolate affected system (disconnect from network)
- Long-term: Apply temporary fixes while preparing eradication
- Decisions: shut down vs keep running for evidence collection
- Block attacker IPs at firewall, disable compromised accounts
Phase 4: Eradication
- Remove malware, backdoors, unauthorised accounts
- Patch the exploited vulnerability
- Reset all potentially compromised credentials
- Verify removal with forensic analysis
Phase 5: Recovery
- Restore systems from clean backups or rebuild
- Monitor closely for signs of re-infection
- Gradual return to production (phased approach)
- Validate all systems are functioning correctly
Phase 6: Post-Incident Activity (Lessons Learned)
- Conduct lessons-learned meeting
- Update IR playbooks and detection rules
- Document entire incident timeline
- Improve defences based on findings
- Share IoCs with relevant communities
How Forensics Integrates with IR
Incident Detected → Preserve Evidence → Forensic Analysis → Understand Attack
↓ ↓
Containment ←──── Intelligence from forensics
↓
Eradication (informed by forensic findings)
↓
Recovery → Monitoring → Post-Incident Report
First Responder Responsibilities
- Don’t panic — Follow the playbook
- Document everything — Time, actions taken, observations
- Preserve volatile data — RAM capture before shutdown
- Don’t modify evidence — Use write blockers, forensic images
- Isolate, don’t power off — Network disconnect vs shutdown (depends on scenario)
- Escalate — Notify IR team lead, management, legal (as required)
- Maintain chain of custody — Every evidence item documented
Malware Analysis (Introduction)
Static vs Dynamic Analysis
| Aspect | Static Analysis | Dynamic Analysis |
|---|
| Method | Examine without executing | Execute in controlled environment |
| Tools | strings, file, PE viewers, disassemblers | Sandboxes, debuggers, API monitors |
| Risk | None (malware not executed) | Must be sandboxed |
| Finds | Strings, imports, structure, signatures | Behaviour, network connections, file changes |
Static Analysis Steps
# 1. Check file type
file suspicious.exe
# 2. Calculate hash (check VirusTotal)
sha256sum suspicious.exe
# 3. Extract readable strings
strings suspicious.exe | grep -i "http\|password\|cmd\|shell"
# 4. Check PE headers (Windows)
# Use PEview, pestudio, or readpe
| Tool | Type | Use |
|---|
| Cuckoo Sandbox | Automated sandbox | Execute malware, generate report |
| Any.Run | Cloud sandbox | Interactive analysis |
| Flare VM | Windows analysis VM | Full RE toolkit |
| Process Monitor | Real-time monitoring | File/registry/process activity |
| Wireshark | Network capture | Malware’s network communication |
Ransomware Case Study Approach
- Identify ransomware family — ransom note, file extension, hash lookup
- Determine encryption — reversible or not?
- Check for decryptor — nomoreransom.org
- Preserve encrypted files — may be decryptable later
- Find initial access vector — phishing email, RDP brute force, vulnerability
- Timeline reconstruction — when did infection start, what spread where
Forensic Report Writing
Report Structure
| Section | Content |
|---|
| Case Details | Case number, date, examiner, requesting authority |
| Chain of Custody | Evidence items, who handled them, hashes |
| Scope & Methodology | What was examined, which tools were used |
| Tools Used | Tool name + version (important for validation) |
| Findings Timeline | Chronological events with timestamps and evidence sources |
| Detailed Findings | Each artefact: location, timestamp, significance |
| Conclusion | What happened based on evidence |
| Recommendations | Prevent recurrence |
| Appendix | Hash values, chain of custody forms, raw data |
Writing for Different Audiences
| Audience | Style |
|---|
| Technical team | Detailed, include commands, registry paths, log entries |
| Management | High-level summary, business impact, recommendations |
| Legal/Court | Precise language, no assumptions, evidence-backed statements |
Key Principles
- State facts, not opinions — “The log shows…” not “I think…”
- Cite evidence — Every finding must reference specific artefact
- Be objective — Present what evidence shows, not what you want it to show
- Document limitations — What couldn’t be determined and why
Expert Witness Basics
- Forensic examiners may be called as expert witnesses in court
- Must explain technical findings in plain language
- Affidavit — Written sworn statement of findings
- Must be prepared to defend methodology under cross-examination
Emerging Trends
| Trend | Impact on Forensics |
|---|
| AI in forensics | Automated timeline analysis, anomaly detection in large datasets |
| Anti-forensic techniques | Log wiping, timestamp manipulation, encryption, steganography |
| IoT forensics | Smart home devices, wearables — new evidence sources |
| Cloud-native forensics | Serverless, containers — ephemeral evidence |
| Deepfakes | Digital evidence authenticity challenges |
Notable Cybercrime Cases
Indian Cases
- Bazee.com case (2004) — CEO arrested for obscene content listed on platform
- Pune Cosmos Bank heist (2018) — ₹94 crore stolen via malware on ATM switch server
- Domino’s India data breach (2021) — 180 million order details leaked
International Cases
- Sony Pictures hack (2014) — North Korean attackers (attribution via forensic evidence)
- WannaCry (2017) — Global ransomware, attributed to Lazarus Group
- SolarWinds (2020) — Supply chain compromise discovered via forensic analysis