Following an EDR telemetry alert indicating an active credential-harvesting attempt on a Windows domain controller, a SOC analyst must execute an incident response procedure. In what sequence should the analyst execute the following actions to effectively contain the threat, preserve evidence, and remediate the endpoint?
- 1Apply logical endpoint network isolation through the EDR console to block non-EDR traffic.
- 2Acquire a volatile memory snapshot and process memory dump via EDR live response tools.
- 3Kill the identified malicious parent process tree and unload associated compromised dynamic-link libraries (DLLs).
- 4Quarantine the malicious binary artifacts and remove persistence mechanisms such as compromised scheduled tasks.
- 5Release the endpoint from network isolation and verify baseline security policy compliance.
Cevap
The correct order of incident response steps is: Apply logical endpoint network isolation through the EDR console -> Acquire a volatile memory snapshot via live response -> Kill the malicious process tree -> Quarantine binary artifacts and remove persistence -> Release the endpoint from network isolation.
The response sequence follows standardized incident handling rules adapted for EDR capabilities. First, host network isolation is applied to halt C2 communications and lateral movement without severing the management channel. Second, volatile memory and telemetry must be collected while processes remain active to capture memory evidence. Third, the malicious process tree is killed to stop execution. Fourth, persistence mechanisms are purged and malicious binaries quarantined. Finally, network isolation is lifted after verifying the host is clean and compliant.
Adım Adım Çözüm
Anahtar Kavram
EDR Automated Containment and Sequential Incident Response Workflow