An analyst finds .xyz files of unknown origin that are large and undetected by antivirus. What action should be taken next?

The scenario describes a classic indicator of a potential advanced threat, such as a zero-day exploit, custom malware, or a staged data exfiltration package. Since signature-based antivirus (AV) has failed, the next logical step in the incident response process is containment followed by deeper analysis. Isolating the files prevents potential execution or spread, fulfilling the containment objective. Performing heuristic and behavioral analysis in a controlled environment (e.g., a sandbox) is necessary to understand the function of an unknown file that evades traditional detection methods. This approach safely determines the nature of the threat without destroying critical forensic evidence.

B. Renaming a file does not alter its potential maliciousness; opening it, even in a text editor, is extremely risky and could trigger an exploit.
C. Immediate deletion constitutes premature eradication, destroying valuable evidence needed to understand the attack's scope, origin, and impact on other systems.
D. Malicious files must be analyzed in a highly secure, isolated environment (sandbox), not a less secure segment, which would increase the risk of network-wide compromise. ---

1. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide": This guide outlines the standard incident response lifecycle. The described situation falls into the "Analysis" phase. Section 3.3.2

"Forensic Analysis

" details the need to analyze artifacts like suspicious files. It states

"A malware analysis environment

often a sandbox

can be used to observe the behavior of a file." This directly supports performing a deeper analysis. Furthermore

Section 3.2.2

"Containment Strategy

" emphasizes isolating affected systems or files to prevent further damage.

Source: Bowen

P.

et al. (August 2012). Computer Security Incident Handling Guide. NIST Special Publication 800-61 Rev. 2. National Institute of Standards and Technology. Page 29

Section 3.3.2.

2. Cisco Official Documentation

"Cisco Secure Malware Analytics (Threat Grid) Data Sheet": This document describes the purpose of Cisco's advanced malware analysis tool. It states that the platform "provides deep

context-rich malware analysis" for threats that "evade traditional security tools." It analyzes file behavior in a sandbox

which is a form of heuristic/dynamic analysis. This aligns perfectly with the action of performing a "deeper heuristic analysis" on a file undetected by standard AV.

Source: Cisco. (2021). Cisco Secure Malware Analytics (Threat Grid) Data Sheet. Cisco Public Information. Document C78-742351-03. Page 2

"Product overview."

3. Academic Publication

"A Survey of Malware Analysis Techniques": This peer-reviewed article discusses the limitations of signature-based detection and the necessity of behavioral (dynamic) analysis for unknown malware. The paper explains

"Dynamic analysis techniques are used to execute the malware in a controlled environment

such as a virtual machine or a sandbox

and monitor its behavior." This validates the need for deeper analysis when initial scans fail.

Source: Egele

M.

et al. (2012). A Survey of Malware Analysis Techniques. ACM Computing Surveys

44(2)

Article 6. https://doi.org/10.1145/2089125.2089126. Section 3

"Dynamic Analysis."