domains / families / security / containing-active-breach

containing-active-breach

separate

'Executes containment strategies to stop active adversary operations

When to use

• A confirmed intrusion is in progress with an active adversary on the network
• Malware is spreading laterally across endpoints or servers
• A compromised account is being used for unauthorized access to systems
• Ransomware encryption has been detected and is actively propagating
• An attacker has established command-and-control communications from internal hosts

When not to use

• post-incident cleanup when the adversary is no longer active
• eradication procedures

Skill page

Source