A team of security analysts has been alerted to potential malware activity.
The initial examination indicates one of the affected workstations is beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445
Which of the following should be the team's NEXT step during the detection phase of this response process?
Click on the arrows to vote for the correct answer
A. B. C. D.D.
The next step that the security analysts should take during the detection phase of this response process would be to identify potentially affected systems by creating a correlation search in the SIEM based on the network traffic. The rationale behind this decision is that the initial examination has already provided the team with some critical pieces of information that point to the possibility of a malware attack. By conducting a correlation search, the analysts can gather more information about the network traffic patterns and identify other workstations that may have been affected by the same malware.
Option A, Escalating the incident to management, who will then engage the network infrastructure team to keep them informed, may be necessary in some cases. However, at this stage, the security analysts should focus on gathering more information about the nature and scope of the attack before involving other teams.
Option B, Depending on system criticality, remove each affected device from the network by disabling wired and wireless connections, may also be necessary in some cases. However, it is not a practical solution at this stage as it may disrupt critical business operations and may not effectively address the root cause of the attack.
Option C, Engage the engineering team to block SMB traffic internally and outbound HTTP traffic to the five IP addresses, may also be necessary in some cases. However, it is not the next logical step at this stage as the security analysts need to gather more information about the nature and scope of the attack before taking any remediation actions.
In summary, the best option at this stage is to identify potentially affected systems by creating a correlation search in the SIEM based on the network traffic. This will enable the security analysts to gather more information about the nature and scope of the attack and identify other workstations that may have been affected by the same malware.