During an ongoing security breach, an Incident Response Team (IRT) identifies that an attacker has gained access to internal endpoints using harvested domain administrator credentials and is actively attempting lateral movement across enterprise network segments via pass-the-ticket techniques. Which of the following containment actions should the IRT execute IMMEDIATELY to stop ongoing lateral movement while preserving evidence integrity? (Select TWO.)
- Place affected endpoints into network quarantine VLANs or apply host-level isolation rules to block non-essential communications.Answer
- Reset compromised user credentials and force a double reset of the Kerberos Ticket Granting Service account (KRBTGT) password.Answer
- CImmediately re-image the operating systems of all affected workstations using known-good baseline gold images.
- DDeploy Web Application Firewall (WAF) rules to block incoming parameterized SQL queries on perimeter gateways.
Answer
The incident response team should place affected endpoints into network quarantine or isolate them at the host level, and reset compromised credentials along with the Kerberos Ticket Granting Service account (KRBTGT) password.
During the containment phase of an incident response process involving Active Directory credential theft and lateral movement, the priority is stopping further adversary spread while maintaining evidence integrity. Network/host isolation prevents C2 traffic and lateral connections while keeping volatile memory intact for digital forensics. Resetting compromised domain credentials along with a double reset of the KRBTGT password invalidates stolen Kerberos tickets, preventing ongoing unauthorized authentication across the enterprise domain.
Step-by-Step Solution
Key Concept
NIST Incident Response Containment Strategy & Active Directory Attack Remediation