During operational threat hunting, a security analyst detects an internal workstation communicating with an unrecognized external IP address using DNS over HTTPS (DoH). Detailed inspection of the query logs reveals that sensitive file paths and directory metadata are being systematically encoded into subdomains and sent outside the enterprise network. According to standard incident response lifecycle guidelines (NIST SP 800-61), which of the following actions should the incident response team execute FIRST upon confirming this activity?
- Isolate the workstation from the network and block the external destination IP address.Answer
- BDelete the compromised data files on the workstation and restore them from a clean backup.
- CUpdate perimeter firewall rules to block incoming SQL injection payload strings across web portals.
- DExecute host anti-malware software to remove self-replicating network worm binaries from volatile RAM.
Answer
Isolate the workstation from the network and block the external destination IP address.
According to the NIST Incident Response Framework, once an incident involves active data exfiltration, the team must prioritize Containment. Isolating the impacted workstation and restricting destination communication prevents further loss of confidential data while maintaining the system state for forensic investigation.
Step-by-Step Solution
Key Concept
Containment Phase Actions in Incident Response Playbooks