Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A security analyst receives a high-severity alert from an Endpoint Detection and Response (EDR) agent indicating that a malicious WMI event subscription has been registered on a critical enterprise server and is attempting to execute unauthorized PowerShell scripts. Place the containment and incident response steps in the correct sequential order from initial response to final remediation.

  1. 1Analyze EDR telemetry alerts and confirm the anomalous WMI process lineage.
  2. 2Initiate host-level network isolation via the EDR console to prevent lateral movement.
  3. 3Terminate active malicious processes and child threads running under the WMI host process.
  4. 4Use EDR live response tools to gather volatile memory artifacts and process inspection logs.
  5. 5Remove persistent WMI bindings, restore system configurations, and rejoin the host to the network.

Answer

The correct sequence begins with validating telemetry alerts, followed by network isolation of the host, process termination, live response artifact collection, and finally persistence cleanup and host restoration.
In standard incident response protocols using EDR technology, the first step is validating telemetry alerts. Once confirmed, immediate network isolation protects the rest of the enterprise from lateral movement. Next, running malicious processes are killed to stop active damage, followed by collecting volatile live response artifacts for root cause analysis. Finally, persistent threat artifacts (such as WMI bindings) are deleted and the clean endpoint is restored.

Step-by-Step Solution

1
Validate the EDR alert and process tree.
Confirmed malicious WMI event execution.
Prevents taking intrusive containment actions on benign system behavior.
2
Isolate the endpoint network interface via EDR capabilities.
Lateral movement vectors are severed while preserving administrative EDR control channels.
Contains potential containment blast radius to the single endpoint.
3
Terminate active malicious processes.
Malicious code stops executing in host memory.
Halts ongoing damage or data collection on the localized system.
4
Collect live response forensic telemetry.
Volatile memory and script logs are saved for root-cause analysis.
Ensures critical forensic evidence is preserved before system modifications occur.
5
Remediate WMI persistence mechanisms and lift host isolation.
System returned to trusted baseline state and reconnected to network.
Completes the lifecycle of endpoint containment and remediation.

Key Concept

EDR Incident Containment and Investigation Workflow
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic