1. Suspect Worm

1.4. Post-op Prevent Recurrence Policy

	1.4.1. Custom IPS Signature Possible?
	1.4.2. Is it possible to leverage Application and Device Control
	1.4.3. Firewall Block policy possible?
	1.4.4. If False Positive Add to Centralized Exceptions Policy in

1.1. Manual Analysis and Remediation Steps

1.2. Wipe/Restore Machine

1.3. Widespread?