A security analyst has received an incident case regarding malware spreading out of control on a customer's network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature. Which of the following should the analyst perform next to determine the type of malware, based on its telemetry?

After an Endpoint Detection and Response (EDR) tool automatically provides a malware signature (e.g., a file hash), the most efficient and logical next step for identification is to cross-reference this signature with threat intelligence sources. These platforms, including open-source ones, aggregate vast amounts of data on known malware. This process links the signature to specific malware families, associated threat actors, and their tactics, techniques, and procedures (TTPs). This action directly addresses the analyst's need to determine the type of malware to inform the subsequent response strategy, fulfilling a key function of the "Analysis" phase in incident response.

B. Configure the EDR to perform a full scan. This action is for determining the scope of the infection (containment), not for identifying the type of malware from an already-obtained signature.
C. Transfer the malware to a sandbox environment. Sandboxing is a resource-intensive dynamic analysis technique best used for unknown malware; checking threat intelligence for a known signature is the faster, preceding step.
D. Log in to the affected systems and run netstat. This is a host-based analysis technique to gather network IOCs, but it does not directly identify the malware type using the signature already provided by the EDR. ---

1. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide." In Section 3.2.2

"Analysis

" the guide emphasizes that after detection

analysts should correlate available data to understand the incident. This includes researching indicators like malware signatures using external intelligence sources to determine the nature of the threat.

2. Carnegie Mellon University

Software Engineering Institute (CMU SEI). In the publication "A Framework for Characterizing and Comparing Threat Intelligence Platforms" (CMU/SEI-2021-TR-001)

Section 2.1 discusses the core function of these platforms is to "collect and process data... to produce threat intelligence." An analyst using a malware signature as an input to query such a platform is a primary use case for identifying threats.

3. SANS Technology Institute. Courseware for cybersecurity programs

such as FOR508: Advanced Incident Response

Threat Hunting

and Digital Forensics

establishes a standard incident response triage process. A fundamental first step after acquiring an indicator of compromise (IOC) like a malware hash is to query threat intelligence platforms (e.g.

VirusTotal) to rapidly identify known threats before proceeding to more in-depth analysis.