Remove hidden malware during a live incident by scoping the infection first, capturing volatile evidence, isolating affected hosts, and then rebuilding from known good sources. Killing one visible process or deleting one file feels fast, but malware built to hide often has a second copy, a persistence hook, or credentials already stolen.
What does "hidden" mean in practice?
Malware hides in a few predictable ways, and MITRE ATT&CK catalogs them. Some tools run payloads reflectively from memory. MITRE's entry for the open source Donut framework, which threat actors have used to load payloads into memory, notes that its code can patch the Antimalware Scan Interface, can erase file references to payloads after they are loaded, and can enumerate processes as injection candidates. Other malware removes its own artifacts or changes file timestamps. MITRE's entry for the Evilnum backdoor lists a function that deletes leftovers of the attack and timestomping of file creation dates.
The lesson is plain. If a payload lives only in memory, a disk scan finds nothing, and a reboot erases your best evidence along with the malware.
Why is real time response risky?
Speed and certainty pull in opposite directions. A responder who kills a process immediately may stop the damage, and may also lose the memory image, tip off the operator, and trigger a destructive fallback. A responder who waits for full analysis may let data leave.
NIST frames incident response as a capability you prepare for, not something improvised. SP 800-61 Revision 3, published in April 2025, places response inside broader risk management. SP 800-83 Revision 1 covers malware incident prevention and handling for desktops and laptops. Neither replaces your own runbook, and both are worth reading before the incident.
A constructed example
A finance workstation shows outbound traffic every 60 seconds to an unfamiliar address. The antivirus console reports clean. The analyst sees a signed system binary spawning a scripting host and suspects code running inside another process.
A weak response restarts the machine and calls it done. A stronger one isolates the host from the network but leaves it powered on, captures memory, records running processes and network connections, and only then lets the team reimage. Meanwhile another analyst searches the rest of the fleet for the same traffic pattern and the same parent and child process chain, because one infected host rarely stands alone.
What order works under pressure?
Contain first, then understand, then eradicate. Containment means cutting network access and disabling the accounts the host used. Understanding means capturing memory and logs and finding how it arrived. Eradication means removing every foothold and rebuilding, not cleaning in place, whenever you cannot prove the host is clean.
Credentials come next. Assume anything on the host was readable. Rotate secrets, tokens and keys that touched it, and review what those credentials could reach.
How to check or apply this
- Declare an incident owner so one person decides between speed and evidence.
- Isolate the host from the network without powering it off.
- Capture memory and volatile data before any cleanup.
- Hunt the fleet for the same indicators and behavior, not just the same file hash.
- Disable accounts and rotate secrets that touched the host.
- Rebuild from a trusted image instead of cleaning in place.
- Look for the entry point, such as a phishing mail, an exposed service or a poisoned dependency, and close it.
- Write down timings and decisions for the post-incident review.
If the entry point was a dependency, a software inventory lets you answer which services shipped the bad package. Safeguard's dependency scanning and reachability analysis can narrow that list. Automated fix pull requests are off by default, so a person still reviews any change.
Quick check
Should I power off an infected machine right away?
Usually isolate it from the network instead. Powering off destroys memory, which may hold the only copy of a fileless payload. Follow your runbook and your incident owner's call.
Is a clean antivirus scan proof that malware is gone?
No. Malware that runs from memory or removes its own artifacts can pass a disk scan. Use memory capture and behavior hunting alongside file scanning.
Sources
- MITRE ATT&CK, Donut (S0695), fetched 18 October 2026.
- MITRE ATT&CK, EVILNUM (S0568), fetched 18 October 2026.
- NIST SP 800-61 Rev. 3, fetched 18 October 2026.
- NIST SP 800-83 Rev. 1, fetched 18 October 2026.
Last reviewed: 18 October 2026.
