Malwarebytes: alert triage and investigation (MITRE mapping)

Goal

Use a repeatable method to handle a Malwarebytes (Nebula / OneView) alert:

• Quickly assess severity
• Collect the right evidence (process, path, user, timeline)
• Decide: false positive vs PUP vs malware vs intrusion
• Contain then remediate
• Document (ticket + MITRE ATT&CK mapping)

Step 1 — Quick triage (2–5 minutes)

1. Open the Malwarebytes console.
2. Go to Detections / Suspicious activity.
3. Open the event and capture:
   • Endpoint / hostname
   • User account
   • Process path + binary name
   • Detection time
   • Action taken (blocked / quarantined / allowed)
   • Severity

Quick decision cues

• PUP/adware on a workstation: often low/medium, standard remediation.
• Unknown executable in a suspicious path: escalate.
• MITRE tags like “Initial Access” / “Lateral Movement”: treat as high severity.

Step 2 — Check endpoint context

1. Is it a critical server or a standard workstation?
2. Look at history:
   • recent detections
   • last seen / agent update

Step 3 — Minimum evidence pack

Collect:

• Full binary path
• Hash (if available)
• Parent process (process tree/graph)
• Command line (if shown)
• File/network artifacts (if available)

Step 4 — Containment (if strongly suspicious)

Depending on your capabilities:

1. Isolate the endpoint (network isolation) if available.
2. Temporarily disable the user account if compromise is likely.
3. Block IOCs:
   • hash, URL, domain
4. Notify stakeholders per internal runbook.

Step 5 — Remediation

PUP / adware

1. Run a full scan.
2. Quarantine/remove detections.
3. Clean:
   • browser extensions
   • installed programs
4. Check scheduled tasks and Run/RunOnce keys.

Malware / suspicious executable

1. Quarantine/remove.
2. Reboot if required.
3. Verify:
   • persistence (services, tasks)
   • abnormal outbound connections
4. Consider reimage if confidence is low.

Step 6 — MITRE mapping (documentation)

In your ticket, record:

• Tactic (e.g., Initial Access)
• Technique (if known)
• Rationale (what evidence supports it)

Step 7 — Closure and prevention

• Update rules/exclusions (only if false positive is proven)
• Add correlated monitoring (RMM/SIEM)
• Maintain an N1 runbook:
  • evidence pack
  • containment steps
  • escalation criteria