During operational monitoring, a Security Operations Center (SOC) analyst identifies unusual Windows Management Instrumentation (WMI) execution on a core Domain Controller, indicating potential credential harvesting. Following the standard NIST SP 800-61 Incident Response Framework, in which chronological sequence should the security team perform the following response procedures?
- 1Analyze SIEM log data and capture volatile system memory to verify the scope and vector of the unauthorized WMI activity.
- 2Implement host-based isolation policies to prevent lateral movement while preserving system memory state.
- 3Purge malicious WMI persistence mechanisms, rotate compromised kerberos keys, and restore the server from a known-good backup.
- 4Conduct a post-incident review meeting and update SIEM correlation rules and playbook workflows based on lessons learned.
Answer
The correct incident response sequence follows the NIST SP 800-61 lifecycle phases: 1) Detection and Analysis (analyzing SIEM logs and memory), 2) Containment (isolating the host), 3) Eradication and Recovery (purging persistence mechanisms and restoring from backup), and 4) Post-Incident Activity (conducting lessons learned and updating rules).
Standard NIST incident response lifecycle dictates progressing through Preparation (pre-established), Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Analyzing logs and volatile memory confirms the threat (Detection and Analysis). Isolating the server stops lateral spread (Containment). Removing artifacts and restoring from backup cleanses the environment (Eradication and Recovery). Finally, conducting a post-mortem review updates organizational playbooks (Post-Incident Activity).
Step-by-Step Solution
Key Concept
NIST Incident Response Lifecycle Phases