Malware hits a workstation at 09:14. The user calls the help desk at 09:23 because the machine is acting weird. The help desk escalates to security at 09:31. By the time the responder sees the ticket, the malware has had 17 minutes to phone home, dump credentials, and reach a domain controller. The first 60 minutes decide whether this is a Tuesday or a quarter. Most playbooks read like they were written by people who have never been paged at 02:00. Here is the one that holds up.
What you do in the first 30 minutes
Do not power the machine off. That destroys volatile evidence and breaks any chance of recovering the process tree, the network connections, and the memory resident payloads. Pull the network cable or disable the WiFi adapter instead. The machine is now isolated but its memory is intact. Open a ticket with a timestamp and start a notes file. Everything the responder does from here is going to be reviewed by counsel, the insurer, and possibly a regulator. Write it down as you go.
Capture RAM first. Memory decays fast, and once the machine reboots it is gone for good. Magnet RAM Capture and WinPmem are the two tools that work reliably across Windows 10 and 11 without crashing the host. Dump to an external USB drive that has been formatted and labelled before the incident. Hash the dump with SHA256 and record the hash in the notes. This is the artefact the forensic report will be built on. Skip this step and the rest of the investigation is guesswork.
What you do in minutes 30 to 60
While the RAM dump runs, pull triage artefacts from the host. Velociraptor is the open source tool that does this fastest. Endpoint, registry hives, scheduled tasks, services, prefetch, recent file opens, and ShimCache. KAPE is the commercial alternative that does similar triage and packages the output for review. Either tool gives a working theory of what ran, when, and how. Run both if disk space allows. The triage output tells you whether this is commodity adware or hands on keyboard.
Now check the network. Even with the host isolated, look at the firewall and proxy logs for outbound traffic from this IP in the last 24 hours. Cobalt Strike, the modern C2 frameworks, and stealer logs all beacon out. If you see traffic to a known bad IP, you have the initial vector. If you see nothing, the malware might be dormant or the host might be patient zero of a wider campaign. Both are bad in different ways. Look at Active Directory for the user’s recent authentications. If the attacker has the user’s hash, lateral movement has happened. The question is how far.
What you do in hours 2 to 8
By now you have RAM, triage artefacts, and a network picture. Build the timeline. Velociraptor’s built in timeline view or Plaso with log2timeline does this. The goal is a single chronological view of every notable event on the host, correlated with the network. Once the timeline is built, the story usually tells itself. Initial access at 08:47, persistence at 08:52, credential theft at 09:01, lateral movement to the file server at 09:08. That is a Cobalt Strike operator who knew what they wanted. Or a commodity loader that pwned a browser extension and is now selling access to your domain for 800 dollars on an access broker forum.
At this point the responder has a decision to make. Contain and remediate, or watch and learn. The instinct is to wipe and rebuild. Sometimes that is the right call. But if you watch, you can find the operator’s other footholds, document their TTPs, and turn the incident into actionable threat intelligence for the rest of the estate. The trade off is real. Every hour you wait is another hour they have access. Most IR firms default to contain. Most sophisticated teams default to watch. The right call depends on the blast radius and the risk appetite, not the playbook.
The bottom line
RAM first, triage second, network third, decision fourth. The order is the playbook. Magnet or WinPmem for memory. Velociraptor or KAPE for triage. The decision at hour two is contain or watch. Most teams default to contain. Most sophisticated teams default to watch. The right call depends on the blast radius, not on the playbook.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
