A security operations center (SOC) analyst confirms an active Golden Ticket attack originating from a compromised Active Directory Domain Controller within an enterprise network. Arrange the following incident response procedures in the correct chronological order according to standard NIST incident response lifecycle guidelines, starting with the earliest step.
- 1Isolate the compromised Domain Controller from the broader network and revoke all active administrative sessions.
- 2Reset the krbtgt account password twice consecutively and purge all persistent malware artifacts from the system.
- 3Restore directory state from verified offline backups, re-engage domain authentication, and monitor Kerberos ticket requests.
- 4Conduct an after-action review to document breach metrics, update Tier-0 incident playbooks, and mandate hardware token MFA.
Cevap
The correct order follows the standard NIST SP 800-61 r2 Incident Response Lifecycle: Containment (network isolation and session revocation) → Eradication (double krbtgt password reset and malware removal) → Recovery (backup restoration, service re-engagement, and monitoring) → Post-Incident Activity (after-action review and playbook updates).
According to standard NIST incident response guidelines (SP 800-61 r2), containment must always precede eradication to restrict adversary movement. Once isolated, eradication eliminates the root cause and attacker access methods (such as invalidating Kerberos TGTs via a double krbtgt reset). Recovery follows to safely restore verified services into production under heightened monitoring, and post-incident activities take place last to document lessons learned and refine security controls.
Adım Adım Çözüm
Anahtar Kavram
NIST Incident Response Lifecycle (Containment, Eradication, Recovery, Post-Incident Activity)