39.8 Incident Response for Malware + CERT-In Awareness
IR lifecycle (short, CEH-friendly): Prepare → Detect → Contain → Eradicate → Recover → Lessons.
Malware-focused actions:
- Contain – isolate host (network pull / EDR isolate); reset shared passwords if credential theft suspected; disable VPN account
- Eradicate – remove persistence, clean or reimage (rootkit / ransomware often → reimage faster than prayer)
- Recover – restore from known-good backup; monitor for re-entry
- Report / assist – organisational IR plan; in India, awareness of CERT-In directions and cybercrime.gov.in / 1930 helpline themes for citizens and orgs (verify current obligations for your entity type – do not invent legal deadlines here)
Preserve evidence when needed (disk image, memory) before reimage if investigation / insurance requires – policy call.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Quiet persistence + delayed ransomware | 24×7 EDR + hunt IOCs; unusual auth after phish |
| Re-enters via same VPN user after weak reset | Forced password reset + MFA revoke sessions; kill tokens |
| Hopes SME never calls IR / CERT channels | Written IR contacts; retainer; CERT-In / cybercrime.gov.in awareness |
Ravindra Bagale's Tip
Students panic madhe del /s ani disk format – evidence udte, insurance / police complaint weak. Contain aadhi, photograph ransom note, note time, call IR lead. Interview madhe IR order (contain before eradicate) clear bola.
Practice task
Scenario: Salman's PC at Raja-Rani Traders shows ransom note; file server share \\files\accounts partial encrypt. Write 10-step IR checklist (contain → who to call → backup integrity check → reimage → restore test → user password resets → lessons). No payment steps.
Real incident: LockBit (public reporting)
LockBit is a ransomware operation widely covered in law-enforcement and CERT public reporting (affiliates, leak sites, multi-sector victims). Details evolve with takedowns and rebuilds in the news – class lesson is pattern: initial access + privilege + backup destruction + extortion. Defence: EDR, MFA, tested offline backups, IR readiness. Source: public FBI/CISA / CERT advisories on LockBit (verify latest).
Project: Build it, hack it, fix it
Build: In YOUR host-only lab, prepare a disposable Windows (or Linux) VM for fictional Sahyadri Traders with documented weaknesses: (1) Windows Defender / ClamAV off or exclusions wide open, (2) USB autorun / easy execution from Downloads enabled mindset (or macro-friendly Office lab setting), (3) daily user is local admin, (4) important dummy files only inside VM C:\sahyadri_lab_data (never real data). Snapshot pre-weak. Hack (lab only – SAFE simulation): Use the official EICAR test file and/or a benign pseudo-malware script you write that creates a marker file C:\sahyadri_lab_data\FAKE_RANSOM_NOTE.txt and optionally a .marker_infected flag – do not encrypt, delete, or overwrite real files; do not download ransomware. Show that with weak controls the marker lands and (if Defender off) EICAR is not blocked. Fix: Enable Defender (Tamper protection) or clamav + sudo service clamd start on Linux; remove exclusions; disable autorun; demote user from admin; block macros from internet; create a backup copy offline / second VHD you unplug; document Controlled folder access if Windows. Re-verify: Re-drop EICAR – must be quarantined/detected; re-run pseudo-malware – blocked by ASR/EDR/AV or note what still needs allowlisting policy; capture Event Viewer / Windows Security history or clamscan output in your report for owner Rani. No internet targets, no real malware binaries.