# Containment

> >

- **Type:** Skill
- **Install:** `agentstack add skill-unitoneai-securityskills-containment`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [UnitOneAI](https://agentstack.voostack.com/s/unitoneai)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [UnitOneAI](https://github.com/UnitOneAI)
- **Source:** https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/incident-response/containment
- **Website:** https://www.unitone.ai

## Install

```sh
agentstack add skill-unitoneai-securityskills-containment
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Incident Containment Strategies -- NIST SP 800-61 Rev 2 / MITRE ATT&CK

> **Frameworks:** NIST SP 800-61 Rev 2 (Containment, Eradication, and Recovery), MITRE ATT&CK Enterprise Matrix
> **Role:** SOC Analyst, Security Engineer
> **Time:** 15-30 min
> **Output:** Containment plan with short-term and long-term actions, business impact trade-off analysis, ATT&CK-mapped countermeasures, and rollback criteria

---

## 1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

- **Active incident requires isolation** -- A confirmed security incident is in progress and affected systems must be contained to prevent further damage or lateral movement.
- **Containment strategy selection** -- The responder needs to choose between network isolation, credential revocation, DNS sinkholing, or other containment mechanisms based on incident type and business constraints.
- **Business impact vs. security risk trade-off** -- The containment action may disrupt business operations and the team needs a structured framework to evaluate the trade-off.
- **Attacker technique requires specific countermeasure** -- The identified ATT&CK technique dictates a particular containment approach (e.g., credential theft requires credential revocation, not just network isolation).
- **Containment effectiveness validation** -- Previous containment actions may have been insufficient and the team needs to assess and escalate containment measures.

**Do not use when:** The task is initial incident triage and classification (use ir-playbook), forensic evidence collection (use forensics-checklist), or post-incident review (use post-incident-review).

---

## 2. Context the Agent Needs

Before selecting a containment strategy, gather or confirm:

- [ ] **Incident classification and severity** -- From the ir-playbook assessment (category, SEV level).
- [ ] **Affected systems inventory** -- Hostnames, IPs, cloud resource IDs, services running on affected systems, and their business function.
- [ ] **Attack vector and techniques** -- Known MITRE ATT&CK techniques in use (initial access, lateral movement, persistence, C2).
- [ ] **Attacker access scope** -- What accounts, systems, and network segments has the attacker accessed or potentially compromised?
- [ ] **Business criticality of affected systems** -- Revenue impact, customer impact, SLA obligations, regulatory implications of downtime.
- [ ] **Network topology** -- VLANs, subnets, firewall zones, cloud VPCs, segmentation boundaries relevant to the affected systems.
- [ ] **Evidence preservation status** -- Has volatile evidence been captured? (Reference forensics-checklist.) Containment actions may destroy evidence if not collected first.
- [ ] **Current containment state** -- What actions, if any, have already been taken?

---

## 3. Process

### Step 1: Containment Decision Criteria

NIST SP 800-61 Rev 2 (Section 3.3.1) identifies the following criteria for containment strategy selection. Evaluate each factor before choosing a containment approach:

| Criterion | Question | Impact on Decision |
|-----------|----------|-------------------|
| **Potential damage** | How much additional damage can occur if containment is delayed? | Higher potential damage favors aggressive, immediate containment |
| **Evidence preservation** | Will the containment action destroy critical evidence? | If volatile evidence is not yet captured, delay destructive containment |
| **Service availability** | What business services will be affected by containment? | Business-critical systems may require surgical containment to minimize disruption |
| **Resource requirements** | Does the containment strategy require resources not currently available? | Choose strategies executable with available tools and personnel |
| **Duration** | How long will containment need to remain in place? | Long-duration containment must be sustainable without degrading business operations |
| **Effectiveness** | Will this containment action actually prevent further attacker activity? | Partial containment that the attacker can bypass wastes time and tips off the adversary |

**Containment decision matrix:**

```
                        Business Criticality
                    Low              High
              +-----------+     +-----------+
  Threat   H  | ISOLATE   |     | SURGICAL  |
  Severity I  | Full       |     | Targeted  |
           G  | network    |     | block +   |
           H  | isolation  |     | monitor   |
              +-----------+     +-----------+
              +-----------+     +-----------+
           L  | STANDARD  |     | MONITORED |
           O  | Isolate & |     | Enhanced  |
           W  | schedule  |     | monitoring|
              | rebuild   |     | + planned |
              +-----------+     | response  |
                                +-----------+
```

### Step 2: Short-Term Containment

Short-term containment aims to stop the immediate threat with minimal preparation. These are rapid-response actions executed within minutes to hours.

**Network isolation strategies:**

| Strategy | Method | Use When | Limitations |
|----------|--------|----------|-------------|
| **Port shutdown** | Disable switchport or cloud security group ingress/egress | Single host compromise, not business-critical | Disrupts all services on the host |
| **VLAN isolation** | Move host to quarantine VLAN with restricted routing | Need to maintain some connectivity for evidence collection | Requires network team coordination |
| **Firewall rule** | Block specific IPs, ports, or protocols at perimeter or host firewall | Known C2 infrastructure, specific attack vector | Attacker may use alternate C2 channels |
| **DNS sinkholing** | Redirect malicious domains to controlled IP via internal DNS | C2 communication via domain names | Ineffective if attacker uses direct IP communication |
| **Cloud security group lockdown** | Remove all inbound/outbound rules except management access | Cloud instance compromise | May disrupt dependent services |
| **VPN/remote access revocation** | Disable VPN accounts, revoke remote access tokens | Compromised remote access credentials | Disrupts legitimate remote users on same system |

**Credential revocation strategies:**

| Strategy | Method | Use When | Scope |
|----------|--------|----------|-------|
| **Password reset** | Force password change for compromised accounts | Credential theft confirmed or suspected | Individual accounts |
| **Session invalidation** | Revoke all active sessions and tokens for affected accounts | Session hijacking, token theft | Individual accounts |
| **API key rotation** | Generate new API keys, revoke old keys | API key exposure or misuse | Specific services |
| **Certificate revocation** | Revoke and reissue TLS/mTLS certificates | Certificate compromise, CA compromise | Services using the certificate |
| **Service account reset** | Reset service account passwords and regenerate keys | Lateral movement via service accounts | Downstream services may break |
| **Kerberos ticket reset** | Reset krbtgt account password (twice, per Microsoft guidance) | Golden ticket attack, domain compromise | Domain-wide impact; requires careful planning |
| **MFA token reset** | Deregister and re-enroll MFA devices | MFA bypass, SIM swap, device compromise | Individual users |

### Step 3: Long-Term Containment

Long-term containment allows the organization to maintain operations while keeping the attacker blocked. These actions prepare the environment for eradication.

| Action | Description | Duration |
|--------|-------------|----------|
| **Network segmentation enforcement** | Implement or tighten firewall rules between network segments to prevent lateral movement paths the attacker used | Until eradication complete + validation |
| **Enhanced monitoring deployment** | Deploy additional logging, network capture, or EDR sensors on affected and adjacent segments | Minimum 30 days post-incident |
| **Temporary system hardening** | Apply emergency patches, disable unnecessary services, restrict administrative access to affected systems | Until full rebuild |
| **Backup system deployment** | Stand up clean replacement systems from known-good images to restore business functions while compromised systems remain isolated | Until compromised systems are eradicated and validated |
| **DNS policy enforcement** | Implement DNS filtering to block known-malicious domains and restrict DNS to internal resolvers only | Permanent improvement |
| **Egress filtering** | Restrict outbound network traffic to only approved destinations and protocols | Permanent improvement |

### Step 4: ATT&CK Technique-Specific Containment

Map observed attacker techniques to targeted containment actions. Each ATT&CK technique has containment actions that specifically counter the adversary's capability.

#### Initial Access Containment

| ATT&CK Technique | Containment Action |
|---|---|
| T1566 -- Phishing | Block sender domain/IP at email gateway; quarantine delivered messages; reset credentials of users who interacted with phishing content |
| T1190 -- Exploit Public-Facing Application | Deploy WAF rule to block exploit pattern; take vulnerable application offline or restrict access to VPN-only; apply emergency patch |
| T1078 -- Valid Accounts | Disable compromised accounts; force MFA re-enrollment; review and revoke sessions; audit account activity for lateral movement |
| T1195 -- Supply Chain Compromise | Isolate systems running compromised software; block network communication to compromised vendor infrastructure; roll back to known-good version |
| T1133 -- External Remote Services | Disable compromised VPN/RDP accounts; restrict remote access to allowlisted IPs; require MFA for all remote access |

#### Lateral Movement Containment

| ATT&CK Technique | Containment Action |
|---|---|
| T1021 -- Remote Services (RDP, SSH, SMB) | Block lateral protocols between workstations; restrict admin protocols to jump servers; disable unused remote services |
| T1550 -- Use Alternate Authentication Material (Pass-the-Hash, Pass-the-Ticket) | Reset affected account credentials; clear Kerberos ticket caches; enable Credential Guard; restrict NTLM authentication |
| T1210 -- Exploitation of Remote Services | Isolate vulnerable systems; apply emergency patches; restrict network access to affected services |
| T1570 -- Lateral Tool Transfer | Block SMB/admin shares between endpoints; restrict PowerShell remoting; deploy application whitelisting |

#### Command and Control Containment

| ATT&CK Technique | Containment Action |
|---|---|
| T1071 -- Application Layer Protocol (HTTP/S, DNS) | Block C2 IPs/domains at firewall and proxy; implement SSL inspection for identified C2 domains; deploy DNS sinkhole |
| T1572 -- Protocol Tunneling | Inspect and restrict non-standard protocol usage; block unauthorized VPN/tunnel endpoints; deploy deep packet inspection |
| T1573 -- Encrypted Channel | Block C2 IPs at network layer (encryption prevents content inspection); deploy JA3/JA3S fingerprinting to identify C2 TLS signatures |
| T1568 -- Dynamic Resolution (DGA, DNS Calc) | Deploy DNS analytics to detect DGA patterns; restrict DNS to internal resolvers; implement DNS response policy zones (RPZ) |

#### Persistence Containment

| ATT&CK Technique | Containment Action |
|---|---|
| T1053 -- Scheduled Task/Job | Audit and remove unauthorized scheduled tasks; restrict task creation permissions; monitor task scheduler logs |
| T1547 -- Boot or Logon Autostart Execution | Audit startup entries (Run keys, startup folders, systemd units); restrict write access to autostart locations |
| T1505.003 -- Web Shell | Scan web-accessible directories for unauthorized files; deploy file integrity monitoring; restrict write permissions on web roots |
| T1136 -- Create Account | Audit and disable unauthorized accounts; restrict account creation permissions; alert on new account creation |

### Step 4b: Wiper / Destructive Malware Containment

Wiper and destructive malware require a distinct containment approach from ransomware or standard malware. The goal shifts from "stop encryption and preserve data" to "stop destruction and protect remaining systems," since wiped data is irrecoverable.

**Containment priorities (in order):**

1. **Immediate network segmentation** -- Disconnect affected segments at the switch/router level. Wiper propagation via SMB (T1021.002), WMI (T1047), or Group Policy (T1484.001) must be severed before forensic triage.
2. **Preemptive shutdown of unaffected systems** -- If the wiper propagation vector is unknown, power off systems that have not yet been hit. A wiper that has not triggered yet is stopped by a cold shutdown. This is the opposite of ransomware guidance (where you keep systems on for memory forensics).
3. **Protect backup infrastructure** -- Verify offline/immutable/air-gapped backups are intact. Disconnect backup agents and NAS/SAN replication from the network. Wipers frequently target backup systems (Volume Shadow Copies, vCenter, backup catalogs).
4. **Block propagation protocols** -- Emergency firewall rules to block SMB (445), WMI (135/5985/5986), RDP (3389), and PsExec/admin shares between all endpoints. Allow only from designated jump servers.
5. **Disable compromised service accounts** -- Wiper deployment often uses compromised domain admin or service accounts. Disable all accounts showing anomalous activity; reset krbtgt if domain compromise is suspected.

**ATT&CK techniques specific to wiper malware:**

| ATT&CK Technique | Description | Containment Action |
|---|---|---|
| T1485 -- Data Destruction | Overwrite or delete data on local and remote drives | Isolate affected systems; power off systems not yet hit; verify backup integrity |
| T1490 -- Inhibit System Recovery | Delete Volume Shadow Copies, disable Windows Recovery, destroy backup catalogs | Disconnect backup infrastructure from network; verify offline backup integrity |
| T1561.001 -- Disk Wipe: MBR | Overwrite Master Boot Record to prevent boot | Power off unaffected systems; preserve one affected disk for forensics |
| T1561.002 -- Disk Wipe: Content | Overwrite or corrupt file content across volumes | Network segmentation to prevent spread; emergency shutdown of at-risk systems |
| T1047 -- WMI | Remote execution of wiper payload via WMI | Block WMI ports (135, 5985, 5986); disable WinRM on endpoints |
| T1484.001 -- Domain Policy Modification: GPO | Deploy wiper via Group Policy push | Disconnect domain controllers from network if GPO deployment confirmed |

**Key difference from ransomware containment:** Do not attempt to "monitor and observe" a wiper in progress. Every second of observation is data permanently destroyed. Aggressive, immediate containment is always the correct posture for confirmed wiper activity.

### Step 5: Containment Validation

After implementing containment, verify effectiveness before proceeding to eradication.

**Validation checklist:**

| Check | Method | Expected Result |
|-------|--------|----------------|
| C2 communication blocked | Monitor network traffic for C2 indicators | No outbound connections to known C2 IPs/domains |
| Lateral movement blocked | Monitor authentication logs and network flows between segments | No unauthorized cross-segment authentication |
| Compromised credentials revoked | Attempt authentication with known-compromised credentials | Authentication fails |
| Attacker persistence neutralized | Scan for known persistence mechanisms | No active persistence artifacts |
| Business services operational (if surgical containment) | Verify critical service health checks | Services responding normally |
| Evidence preserved | Verify forensic images and memory dumps are intact and hashed | Hash verification passes |

**Containment failure indicators:**
- New C2 connections from previously u

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [UnitOneAI](https://github.com/UnitOneAI)
- **Source:** [UnitOneAI/SecuritySkills](https://github.com/UnitOneAI/SecuritySkills)
- **License:** MIT
- **Homepage:** https://www.unitone.ai

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-unitoneai-securityskills-containment
- Seller: https://agentstack.voostack.com/s/unitoneai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.