A.

Information Gathering:
1) Investigation Requirement.
2) Exact Timeline of Infection detection.
3) Logs from the infected device
 Event Logs
 Firewall Logs
 EDR/AV Logs
4) In case of server
 Server Logs
 Firewall Logs
 Application Logs
 WAF Logs

B. Steps of Investigation:
1) In order to identify the suspicious communication over the network start with
examining Firewall Logs/Proxy Logs/Network Traffic Logs.
2) Based on analysis identify/determine the communication observed towards outside
of business domain on suspicious port.
3) Based on these logs enlist all the suspicious domain/IP address &validate them on
threat intel platforms.
4) It will help us to identify if any C2 communication is present.

C. Moving Forward will start investigating system Event Logs.

1) In system Event Logs we will try to correlate the events observed with respect to the
identified suspicious network connections.
2) We will analyse the system system security Logs to validate any system level security
changes are observed.
3) We will analyse system application logs
4) We will analyse system EDR logs.

D. Moving forward will start investigating Server

1) In case of Server we will analyse below mentioned logs
 WAF Logs
 Application Logs
 Server Logs
 Firewall/Network Logs
2) In order to Identify if any persistence will investigate registry key, scheduled task
3) Based on analysis report will enlist all threat vector and will block the same at
respective devices to prevent infection spreading.