You are aSOC Analyst of a company XYZ that has implemented Microsoft Defender for Endpoint.
You are allocated an incident with alerts related to a doubtful PowerShell command line.
You start by going through the incident and apprehend all the related alerts, devices, and evidence.
You open the alert page to evaluate the Alert and choose to perform further analysis on the device.
You open the Device page and decide that you require remote access to the device to collect more forensics information using custom .ps1 script.
One of the below is a Device action.
Identify?
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: B
You can't issue either reboot, reinstall or reformat action.
You can perform isolation devices.
Depending on the severity of the attack and the sensitivity of the device, you might want to isolate the device from the network.
This action can help prevent the attacker from controlling the compromised device and performing further activities such as data exfiltration and lateral movement.
Reference:
The correct device action in this scenario is "Isolate device".
Isolating a device means that the device is disconnected from the network to prevent any potential compromise from spreading. This action is typically taken when a device is suspected of being compromised or infected with malware, to prevent further damage to the network and other devices.
In this scenario, the SOC analyst wants to perform further analysis on the device, which may involve running custom scripts that could potentially make changes to the device or network. Before performing any such actions, it is important to isolate the device to prevent any potential compromise from spreading to other devices on the network.
Reformatting the device and reinstalling the operating system are extreme measures that are typically only taken as a last resort when all other options have been exhausted, and there is a high level of certainty that the device is compromised beyond repair. In this scenario, it is not necessary to take such drastic actions.
Rebooting the device may be necessary in some cases, but it is not a sufficient action to address the potential compromise. Rebooting the device may only temporarily halt any malicious activity, but it does not address the root cause of the problem.
Therefore, the best option is to isolate the device, which will prevent any potential compromise from spreading to other devices, while allowing the SOC analyst to perform further analysis and gather more information about the incident.