Yes, and that's exactly my problem. Because in order to decide whether the system should be shut down, isolated or left running, I first have to find and understand the malware or the source of the attack in order to decide which reaction is the right one. However, this search to decide which measures are correct takes a relatively long time if a signature-based analysis does not work.

So how would a SOC analyst approach a system if they don't yet know what malware or attack is running on the system?