Malware Lateral Movement Assessment and Response

Playbooks

Powershell Payload Response

• Switch usage of deprecated Isolate Endpoint - Generic playbook with the Isolate Endpoint - Generic V2 playbook.

This playbook identifies and remediates malware's lateral movement impact due to a phishing campaign in an organization.

This playbook takes the hosts and attachments with the phishing email and then 1. It scans at the endpoint on which the phishing link was clicked and takes action to resolve any C&C activity and 2. It retroactively scans the logging history to identify lateral movement and quartines or resolve the traffic communication from those hosts