A Security Operations Center (SOC) analyst receives a high-severity alert from an enterprise Endpoint Detection and Response (EDR) platform. Telemetry indicates an unprivileged user account initiated a obfuscated command execution that attempted process injection into `lsass.exe` and established an encrypted outbound connection to an untrusted external IP address. Which TWO of the following actions represent capabilities native to an EDR solution that the analyst should execute to contain the threat and facilitate analysis?
- Apply host network isolation through the EDR agent software to sever attacker communication while maintaining management console connectivity.Answer
- BPush a static signature file update across all network legacy antivirus endpoints to block the obfuscated command hash.
- Issue a remote live response command via the EDR console to dump volatile RAM contents and terminate the malicious parent process tree.Answer
- DReconfigure the perimeter egress firewall rules to block traffic directed to the external destination IP address.
Answer
The analyst should isolate the host via the EDR agent console and execute a remote live response action to dump volatile memory and kill the malicious process tree.
Host network isolation directly through the EDR console stops malicious communication while preserving management control, and remote live response tools enable analysts to capture volatile memory and terminate running processes on the target host.
Step-by-Step Solution
Key Concept
EDR Host Containment and Live Response Features
Estimated Time:1m 30s