2. Suspect Advanced Persistent Threat

2.3. Widespread?

2.3.1. Activate Incident Response Team?

2.1. Manual Analysis and Remediation Steps

2.2. Wipe/Restore Machine

2.4. Post-op Prevent Recurrence Policy