Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

A Security Operations Center (SOC) analyst receives an active EDR behavioral alert indicating that an unauthorized process executed `vssadmin.exe delete shadows /all /quiet` on an enterprise workstation and is actively attempting to encrypt files on connected SMB shares. Place the incident response actions in the correct chronological sequence to contain the threat and perform initial triage.

  1. 1Initiate host-level network isolation through the EDR console to block lateral traffic while maintaining agent-to-console communication.
  2. 2Revoke active session tokens and disable the compromised user account credentials in the central identity provider.
  3. 3Execute an EDR agent action to kill the malicious process tree and pull a volatile memory dump for execution analysis.
  4. 4Collect endpoint telemetry logs and sample payloads via EDR remote shell for root-cause analysis and threat hunting.

Answer

The correct sequence of actions is: 1) Initiate host-level network isolation through the EDR console, 2) Revoke active session tokens and disable compromised user account credentials, 3) Execute an EDR agent action to kill the malicious process tree and pull a volatile memory dump, and 4) Collect endpoint telemetry logs and sample payloads via EDR remote shell.
In EDR incident response, immediate containment takes precedence over investigation steps. Isolating the host via the EDR agent instantly restricts network connectivity and prevents lateral encryption across SMB shares without severing EDR console access. Next, revoking identity tokens prevents the attacker from using compromised credentials on other network hosts. Terminating the malicious process and capturing memory stops local damage and captures volatile evidence. Finally, collecting forensic logs enables root-cause analysis.

Step-by-Step Solution

1
Isolate the host at the network layer via EDR console.
The endpoint is restricted from communicating with the broader network and network shares, halting encryption of remote assets.
Host isolation is the immediate priority during active ransomware behavior to prevent lateral movement while preserving EDR agent control.
2
Disable compromised account credentials and revoke active domain tokens.
Stolen credentials cannot be reused elsewhere in the environment.
Threat actors often pivot to other hosts using compromised account tokens if credentials are not invalidated immediately following host containment.
3
Terminate the malicious process tree and capture volatile system memory.
Ransomware file encryption stops on the local endpoint, and volatile memory is captured for analysis.
Stopping active malicious processes prevents further local damage, and capturing RAM before rebooting preserves injects and cryptographic keys.
4
Extract forensic artifacts and telemetry logs via EDR remote management capabilities.
Responders gain access to event logs, drop files, and execution timestamps.
Detailed forensic triage allows analysts to determine the initial access vector and develop enterprise-wide detection rules.

Key Concept

EDR Incident Containment and Response Workflow
Estimated Time:2m 0s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic