The human resources department should be involved in incident response, to ensure that the incident response process captures evidence needed in case of disciplinary actions against any employees who may have caused or contributed to the incident, either intentionally or unintentionally. The human resources department can also help with enforcing policies and procedures, communicating with employees, and providing legal or ethical guidance.

The first action that should be taken to prevent a more serious compromise is to check the hash signatures, comparing them with malware databases to verify if the files are infected. This will help to determine if the changes to hash signatures were caused by malicious software or legitimate updates. If the files are infected, they should be quarantined and removed from the network. Checking the hash signatures will also help to identify the type and source of the malware, which can inform further actions such as blocking malicious domains or IPs, updating antivirus signatures, or notifying users3.