Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) alert indicating an unauthorized process injection attempt on a critical financial application server. What is the correct operational sequence of actions to take when responding to this incident, ordered from the initial containment step to the final system restoration?

  1. 1Initiate agent-based network isolation on the affected host while maintaining EDR management connectivity.
  2. 2Terminate the injected malicious processes and associated parent execution trees.
  3. 3Capture volatile process memory dumps and forensic telemetry from the isolated host.
  4. 4Execute automated EDR remediation playbooks to purge persistence mechanisms and restore modified system files.

Answer

The correct sequence of EDR incident response actions is: 1) Initiate agent-based network isolation, 2) Terminate injected malicious processes, 3) Capture volatile process memory dumps and forensic telemetry, and 4) Execute automated EDR remediation playbooks to purge persistence mechanisms.
The standard EDR containment workflow prioritizes immediate threat isolation (isolating the endpoint from the network while maintaining agent control), followed by stopping active execution (terminating injected processes), collecting volatile forensics for investigation, and finally remediating persistence mechanisms and restoring system integrity.

Step-by-Step Solution

1
Network Isolation
The host is isolated from the enterprise network, restricting network traffic strictly to EDR control communications.
Immediate containment halts potential lateral movement and command-and-control (C2) communication before further escalation occurs.
2
Process Termination
Active malicious process execution and child processes are stopped.
Halting the injected process prevents ongoing unauthorized activity and potential local damage.
3
Forensic Data Collection
Volatile memory and telemetry are gathered for root-cause analysis.
Acquiring evidence from the contained host ensures indicators of compromise (IoCs) and root cause can be investigated safely.
4
Persistence Removal and Restoration
Malicious artifacts are removed and system integrity is confirmed.
Purging persistence artifacts prevents re-infection when the endpoint is un-isolated and restored to operational service.

Key Concept

EDR Automated Containment and Incident Response Workflow
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic