During incident response triage, an analyst discovers a suspicious process with PID 4812 running on a Windows system. The process is listed as 'lsass.exe' but the path is 'C:\Windows\Temp\lsass.exe'. What is the most important immediate action?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — treat this as confirmed malware because real lsass.exe lives in System32, not Temp. Before you terminate anything, document the parent PID, command line, and hash so you preserve forensic evidence and escalate with full context.
Full Explanation
The correct action is to document process details (parent PID, command line, hash), compare against legitimate lsass.exe (always at C:\Windows\System32\), and treat this as a confirmed masquerading technique requiring full incident escalation. The fake lsass.exe is confirmed malware by its path because the legitimate file is always in System32. Before terminating, documenting the process tree, parent process, command line arguments, and file hash preserves forensic evidence while enabling proper incident escalation with full context. Terminating the process immediately using Task Manager to stop any potential credential theft is wrong because it destroys volatile forensic evidence (process arguments, parent process, network connections, memory) before collection. Allowing the process to continue running and submitting it to the SIEM for correlation is wrong because it lets known malware continue attacker operations while waiting for correlation. Running antivirus scan on the file and waiting for results before taking any action is wrong because it delays response when masquerading already confirms malicious intent, and antivirus may not detect novel malware.