Incident Response · Topic 4 of 6
Responding to Insider and Malware Incidents
Learn how a SOC responds to insider incidents with HR and legal, and to malware and ransomware with isolation, eradication and recovery, for CSA 312-39.
- 5 min
- Insiders use valid access, so UEBA and DLP catch them better than signature tools.
- Insider cases need HR and legal, need to know handling and careful evidence preservation.
- For malware, isolate first, then identify, scope, block, eradicate and recover.
What it is
An insider incident is harm caused by someone with legitimate access: an employee, contractor or partner. It may be malicious (data theft, sabotage), negligent (sending data to the wrong person) or the result of a compromised insider account.
A malware incident is infection by malicious software such as a virus, worm, trojan, ransomware, spyware, rootkit or a backdoor. The response aims to stop the spread, remove the malware and restore clean systems.
How it works
Indicators of insider activity
| Indicator | Example |
|---|---|
| Unusual data movement | Large downloads, uploads to personal cloud storage, mass printing |
| Removable media | USB storage used by someone who never uses it |
| Access outside need | Browsing HR or finance shares unrelated to the job |
| Odd timing | Activity at night or right before resignation |
| Privilege misuse | An administrator creating accounts or disabling logging |
| Policy alerts | DLP blocks, UEBA risk score jumps |
User and entity behavior analytics (UEBA) compares a user's activity with their normal baseline, so it suits insiders who use valid credentials.
Responding to an insider incident
Insider cases are sensitive, because they involve an employee's job and legal rights.
| Step | Action |
|---|---|
| Involve HR and legal early | They decide what can be monitored and how to act lawfully |
| Keep it need to know | Avoid tipping off the subject; restrict who knows |
| Preserve evidence | Collect logs, DLP records, email and endpoint data with chain of custody |
| Contain | Reduce or revoke access, disable accounts at the agreed time, recover company devices |
| Assess impact | What data left, where it went, who must be notified |
| Improve controls | Least privilege, separation of duties, offboarding checklists, DLP tuning |
For a negligent insider, the response is usually to contain the data exposure, retrain the user and fix the process. For a malicious insider, legal may involve law enforcement.
Indicators of malware
Common signs are antivirus or EDR detections, new unknown processes, unexpected outbound connections or beaconing to one address at regular intervals, new services or scheduled tasks, disabled security tools, high CPU, and for ransomware, files renamed with new extensions and ransom notes.
Useful Windows evidence includes process creation (event ID 4688 or Sysmon event ID 1), new service installs (System log event ID 7045), scheduled task creation (4698) and audit log cleared (1102).
Responding to a malware incident
| Stage | Action |
|---|---|
| Contain | Isolate the host from the network (EDR isolation or unplugging), keep it powered on |
| Identify | Get the file hash and name, check threat intelligence and sandbox results |
| Scope | Search EDR and SIEM for the same hash, domain or behavior on other hosts |
| Block | Add hashes, domains and IP addresses to EDR, proxy, firewall and email blocklists |
| Eradicate | Remove the malware and its persistence; reimage when integrity is in doubt |
| Recover | Restore data from clean backups, patch the entry point, reset credentials it could reach |
| Monitor | Watch for reinfection and the same indicators |
Keeping the host on preserves memory, which may hold decryption keys, injected code and network connections.
Ransomware specifics
Isolate affected hosts and shares quickly to stop encryption spreading. Identify the strain, check whether backups are intact and offline, and involve management, legal and, where required, law enforcement and regulators.
Many ransomware groups also steal data before encrypting, so treat the case as a possible data breach. Recovery is normally from clean backups after the entry point is closed.
A worked example
EDR alerts that an Office document spawned PowerShell, which downloaded an executable and connected to an external address every 60 seconds. The analyst isolates the laptop through the EDR console and records the file hash.
A search finds the same hash on two other hosts, which are isolated too. The domain and hash are blocked everywhere, the three machines are reimaged, the user's password is reset, and macros from the internet are blocked by policy.
How the exam asks about this
- "An employee who resigned last week downloaded thousands of files to a USB drive. Who should the SOC involve before acting?" → HR and legal.
- "What is the first containment step for a workstation with active malware?" → Isolate it from the network while keeping it powered on.
- "Which tool compares a user's behavior with their own baseline to spot insiders?" → UEBA.
What to remember for the exam
- Insiders use valid access, so UEBA and DLP catch them better than signature tools.
- Insider cases need HR and legal, need to know handling and careful evidence preservation.
- For malware, isolate first, then identify, scope, block, eradicate and recover.
- Reimage when you cannot be sure the host is clean.
- Ransomware response depends on intact, offline backups and closing the entry point first.
Do not power off an infected host to stop the malware. Network isolation stops the spread and keeps memory evidence.
Common mistakes
Confronting a suspected insider too early. It can tip them off, destroy evidence and create legal risk; follow HR and legal guidance.
Cleaning one host and stopping. Malware often reaches several machines; scope with the hash and indicators first.
Restoring before closing the entry point. Restored systems are reinfected through the same phishing path or vulnerability.
Check yourself
Why is UEBA useful for insider threats?
It flags activity that differs from a user's normal baseline, even when valid credentials are used.
Why keep an infected host powered on after isolating it?
Memory holds running processes, network connections and sometimes keys that are lost at shutdown.
What should be checked before restoring after ransomware?
That backups are clean and intact and that the attacker's entry point has been closed.
Topic 4 of 6 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.