Isolating a compromised endpoint: standard play

Overview

Fast containment limits lateral movement. This is a field-tested sequence; adapt to your SOC runbooks and insurance requirements.

Immediate actions (order may shift by EDR capabilities)

1. Identify the device, primary user, and privilege level (local admin? cached creds? domain joined?).
2. In MDE (or EDR), isolate device from network except management tunnel if available.
3. Force password reset for interactive accounts on that device if credential theft is suspected.
4. Preserve evidence: snapshot disk or capture triage bundle if legal/IR requires.

Parallel tasks

• Pull timeline of processes, network connections, and file drops.
• Check VPN, RDP, and SMB connections in the preceding 24–72 hours.
• Review email and browser origin if vector unknown.

Containment verification

• Ensure isolation actually blocks lateral paths (some tools allow “custom” allow lists—avoid accidental escape).
• Disable or rotate Kerberos tickets and cloud sessions where applicable.

Recovery decision tree

• Reimage when rootkit suspected, ransomware present, or IR vendor mandates.
• Surgical clean only with senior approval and follow-up monitoring.

Reporting

Document timeline, indicators, scope, and customer notifications in the incident ticket; attach IR retainer reference if used.