How to respond to a Malware Compromised User?

A malware-compromised user is one whose credentials have been harvested by malicious software (stealer logs) from an infected endpoint. Prompt and effective response is critical to contain threats, protect your network, and restore user access securely.

Detection & Alerting

1. Identify the Compromise:

   • Receive alerts via ShadowMap’s Data Breach Module or Automated Credential Checks.

   • Review stealer log details (username, device ID, timestamp).

2. Verify Scope:

   • Confirm if the user’s credentials appear in multiple breach sources or logs.

3. Understand Breach Sources & Frequency:

   • Stealer logs may originate from corporate desktops, personal laptops, or mobile devices via browser sync (e.g., Chrome, Edge).

   • Corporate credentials can leak from personal devices; review log metadata (device IDs, user-agent strings, IP addresses) to infer origin.

   • New campaigns may generate multiple logs for the same user; monitor frequency and patterns.

4. Validate New Stealer Log Breaches:

   • Attempt a secure authentication test to verify if the compromised credentials still work.

   • Classify the device source:

     • Personal Device:

       • Advise the user to change their password immediately.

       • Disable or restrict browser sync for corporate accounts.

       • Review and enforce corporate data-sync policies.

       • Evaluate potential impact on corporate resources and restrict VPN or network access until remediated.

     • Corporate Device:

       • Investigate why endpoint protection (EDR/AV) did not detect the compromise.

       • Update EDR signatures and security policies.

       • Patch and harden the device; perform a full malware cleanup.

   • Document findings and update the incident report accordingly.

Immediate Containment

1. Isolate the Endpoint:

   • Remove the affected device from the network.

   • Disable local and VPN access for the compromised host.

2. Suspend User Access:

   • Temporarily disable the user’s account or revoke active sessions.

   • Block multi-factor authentication (MFA) tokens if possible.

Credential Remediation

1. Force Password Reset:

   • Require the user to set a new, strong password.

   • Enforce MFA re-registration for added security.

2. Revoke Tokens & Keys:

   • Invalidate API keys, OAuth tokens, and service account credentials associated with the user.

   • Update any saved service credentials in CI/CD pipelines or automation scripts.

Endpoint Recovery

1. Malware Scanning & Removal:

   • Run a full antivirus/anti-malware scan on the infected device.

   • Use advanced cleanup tools or re-image the system if infection persists.

2. Patch & Harden:

   • Ensure the OS and applications are updated with the latest security patches.

   • Remove unnecessary software and close unused ports/services.

Post-Incident Actions

1. Audit and Review:

   • Document the incident timeline, actions taken, and lessons learned.

   • Update incident response records and stakeholder communications.

2. Archive Inactive Credentials:

   • Use ShadowMap’s Automated Credential Checks to archive any stale or inactive compromised accounts.

   • Maintain audit logs for compliance and future reference.

Preventive Measures

• User Awareness Training: Educate users on phishing and safe browsing habits.

• Continuous Monitoring: Enable 24/7 endpoint detection and response (EDR) tools.

• Network Segmentation: Limit lateral movement by isolating critical systems.

• Regular Credential Audits: Schedule automated credential checks to catch new compromises early.