A security analyst receives a high-severity EDR alert indicating a fileless process injection attack targeting a critical server. To mitigate lateral movement, preserve evidence, and remediate the incident, the analyst must follow a structured EDR incident response workflow. In what order should the analyst perform the following response actions?
- 1Apply host-level network isolation via the EDR agent while preserving console communication channels.
- 2Acquire volatile memory artifacts and process dumps from the endpoint.
- 3Run automated remediation playbooks to terminate malicious process trees and remove persistence mechanisms.
- 4Distribute newly extracted Indicators of Compromise (IoCs) to global EDR detection rules.
Cevap
The correct order of EDR response actions is: 1) Apply host-level network isolation via the EDR agent while preserving console communication channels, 2) Acquire volatile memory artifacts and process dumps from the endpoint, 3) Run automated remediation playbooks to terminate malicious process trees and remove persistence mechanisms, and 4) Distribute newly extracted Indicators of Compromise (IoCs) to global EDR detection rules.
The proper EDR response workflow prioritizes immediate containment (host network isolation) to stop lateral movement, followed by volatile evidence acquisition (RAM/process dumps) before evidence is destroyed. Once evidence is preserved, active remediation (killing process trees and persistence) is executed. Finally, threat intelligence gained from the incident (IoCs) is deployed globally across all endpoint policies to prevent broader exploitation.
Adım Adım Çözüm
Anahtar Kavram
EDR Incident Containment, Forensic Acquisition, and Remediation Workflow