ThreatDown Malwarebytes

Triage a ThreatDown (Malwarebytes) alert. security-alert-response owns routing,
edr-detection-runbook owns the investigation; you add verifying that its automatic remediation
actually completed and reading PUP and PUM as the policy events they usually are. The rebrand
means older docs use both names. You have no console access: scans, isolation, quarantine, and
policy changes are technician steps you direct and record, never take or invent.

1. Classify the detection class; each is a different workflow:
   - Malware, trojan, or ransomware — a true detection.
   - Exploit or brute-force protection — an attack attempt on the host; check exposure, e.g. RDP
     open to the internet.
   - PUP (bundleware, toolbars) — usually hygiene, not an incident. Not malware in client
     communication, but don't editorialize it to "nothing": it got installed somehow, so note the
     vector.
   - PUM (disabled UAC, hijacked search defaults) — the ambiguous one: user choice, admin tooling,
     or malware residue. Check context before dismissing.

2. Parse the anatomy — endpoint, user, object path and hash, action taken — and route on the
   console's site or client field; low confidence goes to a human.

3. Branch by class. Malware detect-only or not yet quarantined: contain first, isolating the
   endpoint where licensed. Quarantined: verify. PUP on one endpoint: one cleanup ticket noting
   the install source. PUP across a client: a policy conversation — blocking level is the client's
   choice. PUM: have the tech confirm whether an admin tool or the user made the change first.

4. Verify the remediation — "remediated" is a point-in-time claim:
   - Check the reboot-required flag: many remediations complete only after restart, and
     remediated-pending-reboot is not clean.
   - Direct a follow-up scan after the reboot and require a clean result.
   - Confirm quarantine holds the objects claimed.
   - The same detection recurring within days means untouched persistence or a reinfection vector:
     escalate rather than re-remediate in a loop; a third occurrence means the approach is wrong.
     Never close on "remediated" without the reboot check and a clean follow-up scan.

5. Scope-check before closing: the same hash on other endpoints at this client (prior tickets, ~90
   days), persistence, identity (compromised-account-containment). Ransomware goes to
   ransomware-response regardless of the remediated flag.

6. Note the class, verdict, and verification evidence including the post-reboot scan; classify per
   soc-classification-tree, client-facing wording factual (defensive-writing-standard). Quarantine
   restores and exclusions are security decisions: narrowest scope, named approver, review date.

Without documentation the client's PUP-blocking stance is unknown — ask, don't assume. When in
doubt, do nothing irreversible and escalate.