A Security Operations Center (SOC) analyst receives a high-severity Endpoint Detection and Response (EDR) alert indicating an active living-off-the-land attack where a compromised workstation is attempting lateral movement via WMI and fileless memory injection. Arrange the following incident response containment and forensic actions in the correct sequential order from first step to last step.
- 1Initiate soft network isolation on the affected endpoint via the EDR management console to block lateral movement while maintaining agent communication.
- 2Collect a volatile RAM image and active process telemetry dump remotely through the EDR agent.
- 3Terminate the malicious process tree and kill injected code threads on the target host.
- 4Publish the extracted file hashes and behavioral Indicators of Compromise (IOCs) as a global ban rule across all enterprise EDR agents.
Cevap
The correct sequence places host network isolation first, followed by volatile memory collection, active process tree termination, and finally fleet-wide IOC ban rule enforcement.
In security incident response workflows, immediate containment of lateral movement is prioritized first by applying EDR network host isolation. Next, adherence to the order of volatility dictates collecting RAM and process dumps prior to killing active processes. Once volatile evidence is safely captured, active malicious process trees are terminated to stop local adversary activity. Finally, extracted IOCs are distributed enterprise-wide as EDR ban rules to protect remaining fleet endpoints.
Adım Adım Çözüm
Anahtar Kavram
EDR Incident Containment Sequence & Volatility Management