During a threat hunting exercise on an enterprise SCADA network, a SOC analyst identifies an unauthorized background service executing on a primary operational jump server. The rogue process is actively establishing covert encrypted DNS tunnels to external command-and-control (C2) servers to exfiltrate system telemetry. The incident response playbook mandates immediate threat containment while strictly maintaining volatile RAM evidence for subsequent forensics. Which of the following operational steps should the security team perform FIRST to adhere to the containment phase protocols?
- Apply a microsegmentation isolation policy at the managed switch port and firewall to sever outbound network connectivity while keeping the host powered on.Cevap
- BExecute an immediate forced reboot of the operational jump server to kill the rogue background service and clear compromised memory spaces.
- CReimage the operational jump server using a baseline virtual machine snapshot from the secure deployment repository.
- DDeploy a detective intrusion detection rule in the SIEM to suppress future C2 alerts generated by the rogue background process during investigation.
Cevap
The operational team should isolate the jump server at the network level by applying microsegmentation firewall and switch port restrictions while preserving host power state for forensic acquisition.
Network-level microsegmentation isolates the compromised host from the network, immediately stopping data exfiltration and external command-and-control channels without interrupting power, thereby preserving volatile system RAM for forensic memory analysis.
Adım Adım Çözüm
Anahtar Kavram
Containment Strategy & Order of Volatility in Incident Response Playbooks