A cybersecurity analyst detects fileless malware activity on secure endpoints. What should be done next?

Fileless malware operates primarily in a system's volatile memory (RAM) and avoids writing malicious executables to the disk, thereby evading traditional file-based security scanners. The correct incident response procedure begins with containment to prevent the threat from spreading. Isolating the affected endpoints from the network achieves this. Subsequently, because the malicious activity is in memory, a detailed memory analysis (memory forensics) is the critical next step to identify the running processes, network connections, and other artifacts of the fileless malware. This analysis is essential for understanding the scope of the compromise and planning for eradication.

A. This is incorrect because fileless malware does not have "suspicious files" to quarantine, and considering the issue resolved after a single action is premature and unsafe.
C. This action is ineffective as there are no files to delete in a fileless attack. The malware persists in memory, not on the file system.
D. Sharing intelligence is an important, but later, phase of the incident response lifecycle (Post-Incident Activity). The immediate priority is containment and analysis of the active threat.

1. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide": Section 3.3, "Containment, Eradication, and Recovery," outlines that the first step after detection and analysis is containment. It states, "An essential part of containment is decision-making... For example, disconnecting a system from a network... can stop an attack." This supports isolating the endpoint.

2. Cisco, "What Is Fileless Malware and How to Defend Against It?": This official Cisco article explains, "Because fileless malware exists only in RAM, it ceases to exist when the system is rebooted. This makes forensic analysis difficult... Security teams must have the ability to detect malicious activity in memory." This directly supports the need for memory analysis as the primary investigative technique.

3. Cohen, M. (2016). "Basics of Memory Forensics". SANS Institute InfoSec Reading Room. This paper details the necessity of memory forensics for modern threats. On page 3, it states, "Memory forensics is also important for investigating incidents where the evidence of the event does not exist on the hard drive... such as... malware that only runs in memory." This validates memory analysis as the essential method for investigating fileless malware.