A Security Operations Center (SOC) analyst receives an active EDR telemetry alert indicating that a Windows workstation is executing malicious code via a Living-off-the-Land (LotL) binary. Place the following Endpoint Detection and Response (EDR) containment and incident handling actions in the correct chronological order from first step to last step.
- 1Apply software-based host network isolation through the EDR console.
- 2Terminate the malicious process and its associated child process tree via the EDR process lineage view.
- 3Gather volatile system telemetry, including process memory dumps and EDR sensor logs, for analysis.
- 4Remove persistence artifacts, such as malicious scheduled tasks or registry keys, and lift host isolation.
Answer
The correct sequence of actions is: 1) Apply software-based host network isolation through the EDR console, 2) Terminate the malicious process and its associated child process tree via the EDR process lineage view, 3) Gather volatile system telemetry, including process memory dumps and EDR sensor logs, for analysis, and 4) Remove persistence artifacts, such as malicious scheduled tasks or registry keys, and lift host isolation.
In standard EDR incident response workflows, immediate containment (network isolation via the software agent) takes precedence to stop C2 traffic and lateral movement. Next, active malicious process trees are terminated to freeze payload execution. Once contained, volatile forensic artifacts (RAM/process dumps) are collected for root-cause analysis. Finally, persistence mechanisms are eradicated and system integrity is verified before removing isolation.
Step-by-Step Solution
Key Concept
EDR Incident Containment and Response Lifecycle
Estimated Time:1m 30s