Containing Active Breaches

When to Use

• A confirmed intrusion is in progress with an active adversary on the network
• Malware is spreading laterally across endpoints or servers
• A compromised account is being used for unauthorized access to systems
• Ransomware encryption has been detected and is actively propagating
• An attacker has established command-and-control communications from internal hosts

Do not use for post-incident cleanup when the adversary is no longer active; use eradication procedures instead.

Prerequisites

• Confirmed incident classification with P1 or P2 severity from triage
• EDR console access with host isolation capabilities (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne)
• Network firewall and switch management access for segmentation
• Active Directory or identity provider administrative access for credential actions
• Pre-approved containment authority documented in the incident response plan
• Evidence preservation plan to avoid destroying forensic artifacts during containment

Workflow

Step 1: Assess Containment Scope

Before taking containment actions, map the full scope of compromise to avoid partial containment that alerts the adversary:

• Identify all confirmed compromised hosts via EDR telemetry and SIEM correlation
• Map lateral movement paths using authentication logs (Windows Event ID 4624 Type 3 and Type 10)
• Identify all compromised credentials (check for pass-the-hash, Kerberoasting, DCSync activity)
• Determine C2 channels (beacon intervals, domains, IPs, protocols)
• Assess whether the adversary has domain admin or equivalent privileges

Containment Scope Assessment:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Compromised Hosts:     5 (WKSTN-042, WKSTN-087, SRV-FILE01, SRV-DC02, WKSTN-103)
Compromised Accounts:  3 (jsmith, svc-backup, admin-tier0)
C2 Channels:           HTTPS beacon to 185.220.x.x every 60s ± 15% jitter
Lateral Movement:      PsExec via svc-backup, RDP via admin-tier0
Adversary Privilege:   Domain Admin (admin-tier0 compromised)
Data at Risk:          Finance share (\\SRV-FILE01\finance$) accessed

Step 2: Execute Short-Term Containment

Implement immediate actions to stop adversary operations without destroying evidence:

Network Containment:

• Isolate confirmed compromised endpoints via EDR network containment (maintains agent communication)
• Block C2 IP addresses and domains at perimeter firewall and internal DNS
• Implement microsegmentation rules to prevent communication between compromised hosts
• Sinkhole C2 domains at internal DNS to capture connection attempts from undiscovered implants

Identity Containment:

• Disable compromised user accounts in Active Directory (do not delete; preserve audit trail)
• Reset passwords for all compromised accounts
• Revoke active sessions and tokens (Azure AD: Revoke-AzureADUserAllRefreshToken)
• Disable the compromised service account and rotate its credentials
• If Domain Admin is compromised: double-reset the KRBTGT password (reset twice, 12 hours apart)

Endpoint Containment:

• Use EDR to terminate malicious processes on contained hosts
• Block known malicious hashes in EDR prevention policy
• Quarantine identified malware samples
• Disable remote services (WinRM, RDP, SMB) on critical servers not yet compromised

Step 3: Execute Long-Term Containment

Implement sustainable containment while the investigation continues:

• Create network ACLs isolating the compromised VLAN/subnet while allowing business-critical traffic
• Deploy temporary jump hosts for administrators to access contained systems for investigation
• Implement enhanced monitoring (full packet capture) on network segments adjacent to compromised hosts
• Enable advanced audit policies on all domain controllers (4768, 4769, 4771 for Kerberos attacks)
• Deploy canary tokens and honeypot accounts to detect adversary attempts to expand from containment

Step 4: Validate Containment Effectiveness

Confirm that containment measures have stopped adversary operations:

• Monitor for new C2 callbacks from any internal host to known adversary infrastructure
• Check for new lateral movement attempts (failed authentication from disabled accounts)
• Verify that contained hosts cannot reach the internet except through the EDR agent
• Confirm that compromised credentials produce authentication failures
• Review SIEM for any new alerts matching the adversary's known TTPs

…