containing-active-breach

name	containing-active-breach
description	Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.
domain	cybersecurity
subdomain	incident-response
tags	["breach-containment","lateral-movement","network-isolation","credential-revocation","live-response"]
mitre_attack	["T1486","T1021.002","T1078","T1071.001","T1570"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Containing Active Breaches

When to Use

• A confirmed intrusion is in progress with an active adversary on the network
• Malware is spreading laterally across endpoints or servers
• A compromised account is being used for unauthorized access to systems
• Ransomware encryption has been detected and is actively propagating
• An attacker has established command-and-control communications from internal hosts

Do not use for post-incident cleanup when the adversary is no longer active; use eradication procedures instead.

Prerequisites

• Confirmed incident classification with P1 or P2 severity from triage
• EDR console access with host isolation capabilities (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne)
• Network firewall and switch management access for segmentation
• Active Directory or identity provider administrative access for credential actions
• Pre-approved containment authority documented in the incident response plan
• Evidence preservation plan to avoid destroying forensic artifacts during containment

Workflow

Step 1: Assess Containment Scope

Before taking containment actions, map the full scope of compromise to avoid partial containment that alerts the adversary:

• Identify all confirmed compromised hosts via EDR telemetry and SIEM correlation
• Map lateral movement paths using authentication logs (Windows Event ID 4624 Type 3 and Type 10)
• Identify all compromised credentials (check for pass-the-hash, Kerberoasting, DCSync activity)
• Determine C2 channels (beacon intervals, domains, IPs, protocols)
• Assess whether the adversary has domain admin or equivalent privileges

Containment Scope Assessment:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Compromised Hosts:     5 (WKSTN-042, WKSTN-087, SRV-FILE01, SRV-DC02, WKSTN-103)
Compromised Accounts:  3 (jsmith, svc-backup, admin-tier0)
C2 Channels:           HTTPS beacon to 185.220.x.x every 60s ± 15% jitter
Lateral Movement:      PsExec via svc-backup, RDP via admin-tier0
Adversary Privilege:   Domain Admin (admin-tier0 compromised)
Data at Risk:          Finance share (\\SRV-FILE01\finance$) accessed

Step 2: Execute Short-Term Containment

Implement immediate actions to stop adversary operations without destroying evidence:

Network Containment:

• Isolate confirmed compromised endpoints via EDR network containment (maintains agent communication)
• Block C2 IP addresses and domains at perimeter firewall and internal DNS
• Implement microsegmentation rules to prevent communication between compromised hosts