Question

During a ransomware incident, the IR team has isolated three infected workstations and confirmed the malware achieved kernel-level persistence and dropped multiple unknown binaries. Anti-malware scans now report the machines as 'clean.' Business leadership is pressing to return the machines to production quickly. As the analyst leading the eradication phase, what is the MOST appropriate course of action?

Accepted Answer

Rebuild the workstations from a known-good image and restore data from validated backups before returning them to production

Answer

Trust the clean anti-malware scan results and reconnect the workstations to the network immediately

Answer

Run a second anti-malware scan with a different vendor's engine and, if also clean, return the machines to production

Answer

Delete the identified malicious binaries manually and re-enable the machines while continuing to monitor them