During a routine audit of enterprise endpoint logs, a threat hunter discovers an unauthorized, memory-resident process running on an HR file server that is actively sending encrypted outbound beacons to a suspicious external IP address. Initial investigation confirms an active Command and Control (C2) connection. According to standard incident response frameworks, which of the following actions should the security team take FIRST?
- Disconnect the infected HR file server from the network segment to prevent lateral movement while maintaining system power to preserve volatile RAM.Answer
- BRe-image the server hard drives using clean gold-master images and restore user data from the most recent backup set.
- CConduct a post-incident review meeting with HR stakeholders to update the organization's incident response playbooks.
- DDeploy updated antivirus signatures across all enterprise endpoints to block the malware payload.
Answer
The security team should first disconnect the infected file server from the network segment to contain the threat while keeping power connected to preserve volatile memory.
According to the NIST Incident Response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), the immediate priority upon confirming an active compromise is containment. Network isolation prevents the attacker from exfiltrating data or moving laterally, while keeping the machine powered preserves volatile memory (RAM) necessary for memory forensics.
Step-by-Step Solution
Key Concept
Incident Response Lifecycle Phases and Containment Strategies