Containment

Incident Containment Strategies -- NIST SP 800-61 Rev 2 / MITRE ATT&CK

> Frameworks: NIST SP 800-61 Rev 2 (Containment, Eradication, and Recovery), MITRE ATT&CK Enterprise Matrix > Role: SOC Analyst, Security Engineer > Time: 15-30 min > Output: Containment plan with short-term and long-term actions, business impact trade-off analysis, ATT&CK-mapped countermeasures, and rollback criteria

---

1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

• Active incident requires isolation -- A confirmed security incident is in progress and affected systems must be contained to prevent further damage or lateral movement.
• Containment strategy selection -- The responder needs to choose between network isolation, credential revocation, DNS sinkholing, or other containment mechanisms based on incident type and business constraints.
• Business impact vs. security risk trade-off -- The containment action may disrupt business operations and the team needs a structured framework to evaluate the trade-off.
• Attacker technique requires specific countermeasure -- The identified ATT&CK technique dictates a particular containment approach (e.g., credential theft requires credential revocation, not just network isolation).
• Containment effectiveness validation -- Previous containment actions may have been insufficient and the team needs to assess and escalate containment measures.

Do not use when: The task is initial incident triage and classification (use ir-playbook), forensic evidence collection (use forensics-checklist), or post-incident review (use post-incident-review).

---

2. Context the Agent Needs

Before selecting a containment strategy, gather or confirm:

• [ ] Incident classification and severity -- From the ir-playbook assessment (category, SEV level).
• [ ] Affected systems inventory -- Hostnames, IPs, cloud resource IDs, services running on affected systems, and their business function.
• [ ] Attack vector and techniques -- Known MITRE ATT&CK techniques in use (initial access, lateral movement, persistence, C2).
• [ ] Attacker access scope -- What accounts, systems, and network segments has the attacker accessed or potentially compromised?
• [ ] Business criticality of affected systems -- Revenue impact, customer impact, SLA obligations, regulatory implications of downtime.
• [ ] Network topology -- VLANs, subnets, firewall zones, cloud VPCs, segmentation boundaries relevant to the affected systems.
• [ ] Evidence preservation status -- Has volatile evidence been captured? (Reference forensics-checklist.) Containment actions may destroy evidence if not collected first.
• [ ] Current containment state -- What actions, if any, have already been taken?

---

3. Process

Step 1: Containment Decision Criteria

NIST SP 800-61 Rev 2 (Section 3.3.1) identifies the following criteria for containment strategy selection. Evaluate each factor before choosing a containment approach:

| Criterion | Question | Impact on Decision | |-----------|----------|-------------------| | Potential damage | How much additional damage can occur if containment is delayed? | Higher potential damage favors aggressive, immediate containment | | Evidence preservation | Will the containment action destroy critical evidence? | If volatile evidence is not yet captured, delay destructive containment | | Service availability | What business services will be affected by containment? | Business-critical systems may require surgical containment to minimize disruption | | Resource requirements | Does the containment strategy require resources not currently available? | Choose strategies executable with available tools and personnel | | Duration | How long will containment need to remain in place? | Long-duration containment must be sustainable without degrading business operations | | Effectiveness | Will this containment action actually prevent further attacker activity? | Partial containment that the attacker can bypass wastes time and tips off the adversary |

Containment decision matrix:

                        Business Criticality
                    Low              High
              +-----------+     +-----------+
  Threat   H  | ISOLATE   |     | SURGICAL  |
  Severity I  | Full       |     | Targeted  |
           G  | network    |     | block +   |
           H  | isolation  |     | monitor   |
              +-----------+     +-----------+
              +-----------+     +-----------+
           L  | STANDARD  |     | MONITORED |
           O  | Isolate & |     | Enhanced  |
           W  | schedule  |     | monitoring|
              | rebuild   |     | + planned |
              +-----------+     | response  |
                                +-----------+

Step 2: Short-Term Containment

Short-term containment aims to stop the immediate threat with minimal preparation. These are rapid-response actions executed within minutes to hours.

Network isolation strategies:

| Strategy | Method | Use When | Limitations | |----------|--------|----------|-------------| | Port shutdown | Disable switchport or cloud security group ingress/egress | Single host compromise, not business-critical | Disrupts all services on the host | | VLAN isolation | Move host to quarantine VLAN with restricted routing | Need to maintain some connectivity for evidence collection | Requires network team coordination | | Firewall rule | Block specific IPs, ports, or protocols at perimeter or host firewall | Known C2 infrastructure, specific attack vector | Attacker may use alternate C2 channels | | DNS sinkholing | Redirect malicious domains to controlled IP via internal DNS | C2 communication via domain names | Ineffective if attacker uses direct IP communication | | Cloud security group lockdown | Remove all inbound/outbound rules except management access | Cloud instance compromise | May disrupt dependent services | | VPN/remote access revocation | Disable VPN accounts, revoke remote access tokens | Compromised remote access credentials | Disrupts legitimate remote users on same system |

Credential revocation strategies:

| Strategy | Method | Use When | Scope | |----------|--------|----------|-------| | Password reset | Force password change for compromised accounts | Credential theft confirmed or suspected | Individual accounts | | Session invalidation | Revoke all active sessions and tokens for affected accounts | Session hijacking, token theft | Individual accounts | | API key rotation | Generate new API keys, revoke old keys | API key exposure or misuse | Specific services | | Certificate revocation | Revoke and reissue TLS/mTLS certificates | Certificate compromise, CA compromise | Services using the certificate | | Service account reset | Reset service account passwords and regenerate keys | Lateral movement via service accounts | Downstream services may break | | Kerberos ticket reset | Reset krbtgt account password (twice, per Microsoft guidance) | Golden ticket attack, domain compromise | Domain-wide impact; requires careful planning | | MFA token reset | Deregister and re-enroll MFA devices | MFA bypass, SIM swap, device compromise | Individual users |

Step 3: Long-Term Containment

Long-term containment allows the organization to maintain operations while keeping the attacker blocked. These actions prepare the environment for eradication.

| Action | Description | Duration | |--------|-------------|----------| | Network segmentation enforcement | Implement or tighten firewall rules between network segments to prevent lateral movement paths the attacker used | Until eradication complete + validation | | Enhanced monitoring deployment | Deploy additional logging, network capture, or EDR sensors on affected and adjacent segments | Minimum 30 days post-incident | | Temporary system hardening | Apply emergency patches, disable unnecessary services, restrict administrative access to affected systems | Until full rebuild | | Backup system deployment | Stand up clean replacement systems from known-good images to restore business functions while compromised systems remain isolated | Until compromised systems are eradicated and validated | | DNS policy enforcement | Implement DNS filtering to block known-malicious domains and restrict DNS to internal resolvers only | Permanent improvement | | Egress filtering | Restrict outbound network traffic to only approved destinations and protocols | Permanent improvement |

Step 4: ATT&CK Technique-Specific Containment

Map observed attacker techniques to targeted containment actions. Each ATT&CK technique has containment actions that specifically counter the adversary's capability.

Initial Access Containment

| ATT&CK Technique | Containment Action | |---|---| | T1566 -- Phishing | Block sender domain/IP at email gateway; quarantine delivered messages; reset credentials of users who interacted with phishing content | | T1190 -- Exploit Public-Facing Application | Deploy WAF rule to block exploit pattern; take vulnerable application offline or restrict access to VPN-only; apply emergency patch | | T1078 -- Valid Accounts | Disable compromised accounts; force MFA re-enrollment; review and revoke sessions; audit account activity for lateral movement | | T1195 -- Supply Chain Compromise | Isolate systems running compromised software; block network communication to compromised vendor infrastructure; roll back to known-good version | | T1133 -- External Remote Services | Disable compromised VPN/RDP accounts; restrict remote access to allowlisted IPs; require MFA for all remote access |

Lateral Movement Containment

| ATT&CK Technique | Containment Action | |---|---| | T1021 -- Remote Services (RDP, SSH, SMB) | Block lateral protocols between workstations; restrict admin protocols to jump servers; disable unused remote services | | T1550 -- Use Alternate Authentication Material (Pass-the-Hash, Pass-the-Ticket) | Reset affected account credentials; clear Kerberos ticket caches; enable Credential Guard; restrict NTLM authentication | | T1210 -- Exploitation of Remote Services | Isolate vulnerable systems; apply emergency patches; restrict network access to affected services | | T1570 -- Lateral Tool Transfer | Block SMB/admin shares between endpoints; restrict PowerShell remoting; deploy application whitelisting |

Command and Control Containment

| ATT&CK Technique | Containment Action | |---|---| | T1071 -- Application Layer Protocol (HTTP/S, DNS) | Block C2 IPs/domains at firewall and proxy; implement SSL inspection for identified C2 domains; deploy DNS sinkhole | | T1572 -- Protocol Tunneling | Inspect and restrict non-standard protocol usage; block unauthorized VPN/tunnel endpoints; deploy deep packet inspection | | T1573 -- Encrypted Channel | Block C2 IPs at network layer (encryption prevents content inspection); deploy JA3/JA3S fingerprinting to identify C2 TLS signatures | | T1568 -- Dynamic Resolution (DGA, DNS Calc) | Deploy DNS analytics to detect DGA patterns; restrict DNS to internal resolvers; implement DNS response policy zones (RPZ) |

Persistence Containment

| ATT&CK Technique | Containment Action | |---|---| | T1053 -- Scheduled Task/Job | Audit and remove unauthorized scheduled tasks; restrict task creation permissions; monitor task scheduler logs | | T1547 -- Boot or Logon Autostart Execution | Audit startup entries (Run keys, startup folders, systemd units); restrict write access to autostart locations | | T1505.003 -- Web Shell | Scan web-accessible directories for unauthorized files; deploy file integrity monitoring; restrict write permissions on web roots | | T1136 -- Create Account | Audit and disable unauthorized accounts; restrict account creation permissions; alert on new account creation |

Step 4b: Wiper / Destructive Malware Containment

Wiper and destructive malware require a distinct containment approach from ransomware or standard malware. The goal shifts from "stop encryption and preserve data" to "stop destruction and protect remaining systems," since wiped data is irrecoverable.

Containment priorities (in order):

1. Immediate network segmentation -- Disconnect affected segments at the switch/router level. Wiper propagation via SMB (T1021.002), WMI (T1047), or Group Policy (T1484.001) must be severed before forensic triage.
2. Preemptive shutdown of unaffected systems -- If the wiper propagation vector is unknown, power off systems that have not yet been hit. A wiper that has not triggered yet is stopped by a cold shutdown. This is the opposite of ransomware guidance (where you keep systems on for memory forensics).
3. Protect backup infrastructure -- Verify offline/immutable/air-gapped backups are intact. Disconnect backup agents and NAS/SAN replication from the network. Wipers frequently target backup systems (Volume Shadow Copies, vCenter, backup catalogs).
4. Block propagation protocols -- Emergency firewall rules to block SMB (445), WMI (135/5985/5986), RDP (3389), and PsExec/admin shares between all endpoints. Allow only from designated jump servers.
5. Disable compromised service accounts -- Wiper deployment often uses compromised domain admin or service accounts. Disable all accounts showing anomalous activity; reset krbtgt if domain compromise is suspected.

ATT&CK techniques specific to wiper malware:

| ATT&CK Technique | Description | Containment Action | |---|---|---| | T1485 -- Data Destruction | Overwrite or delete data on local and remote drives | Isolate affected systems; power off systems not yet hit; verify backup integrity | | T1490 -- Inhibit System Recovery | Delete Volume Shadow Copies, disable Windows Recovery, destroy backup catalogs | Disconnect backup infrastructure from network; verify offline backup integrity | | T1561.001 -- Disk Wipe: MBR | Overwrite Master Boot Record to prevent boot | Power off unaffected systems; preserve one affected disk for forensics | | T1561.002 -- Disk Wipe: Content | Overwrite or corrupt file content across volumes | Network segmentation to prevent spread; emergency shutdown of at-risk systems | | T1047 -- WMI | Remote execution of wiper payload via WMI | Block WMI ports (135, 5985, 5986); disable WinRM on endpoints | | T1484.001 -- Domain Policy Modification: GPO | Deploy wiper via Group Policy push | Disconnect domain controllers from network if GPO deployment confirmed |

Key difference from ransomware containment: Do not attempt to "monitor and observe" a wiper in progress. Every second of observation is data permanently destroyed. Aggressive, immediate containment is always the correct posture for confirmed wiper activity.

Step 5: Containment Validation

After implementing containment, verify effectiveness before proceeding to eradication.

Validation checklist:

| Check | Method | Expected Result | |-------|--------|----------------| | C2 communication blocked | Monitor network traffic for C2 indicators | No outbound connections to known C2 IPs/domains | | Lateral movement blocked | Monitor authentication logs and network flows between segments | No unauthorized cross-segment authentication | | Compromised credentials revoked | Attempt authentication with known-compromised credentials | Authentication fails | | Attacker persistence neutralized | Scan for known persistence mechanisms | No active persistence artifacts | | Business services operational (if surgical containment) | Verify critical service health checks | Services responding normally | | Evidence preserved | Verify forensic images and memory dumps are intact and hashed | Hash verification passes |

Containment failure indicators:

• New C2 connections from previously u

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: UnitOneAI
• Source: UnitOneAI/SecuritySkills
• License: MIT
• Homepage: https://www.unitone.ai

Install and usage instructions live in the source repository linked above.