A security analyst in a Security Operations Center (SOC) receives a high-severity telemetry alert on a database server containing highly sensitive customer data. Analysis of the process execution lineage reveals that an attacker successfully loaded a vulnerable signed kernel driver (BYOVD attack) to blind local auditing tools and disable host firewall rules, subsequently initiating outbound C2 connections over non-standard encrypted ports. Which of the following actions leveraging Endpoint Detection and Response (EDR) features should the analyst execute FIRST to contain the active breach while preserving forensic evidence?
- Apply host network isolation via the EDR management console while leaving the EDR agent communication channel intact.Cevap
- BDeploy a custom static antivirus signature update across the enterprise to automatically identify and delete the vulnerable kernel driver file.
- CUpdate perimeter firewall rules to block the external destination IP address identified in the outbound encrypted network connection.
- DInitiate an automated corrective script to re-enable local host firewall rules and restore local auditing services.
Cevap
The analyst should apply host network isolation via the EDR management console while preserving agent communication channels.
Applying host network isolation via the EDR console immediately blocks all incoming and outgoing network traffic at the host level while leaving the EDR control plane active. This isolates the threat, prevents lateral movement and exfiltration, and maintains volatile memory intact for incident investigation.
Adım Adım Çözüm
Anahtar Kavram
EDR Host Isolation and Telemetry Containment