Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.
A confirmed intrusion is in progress with an active adversary on the network
Malware is spreading laterally across endpoints or servers
A compromised account is being used for unauthorized access to systems
Ransomware encryption has been detected and is actively propagating
An attacker has established command-and-control communications from internal hosts
Do not use for post-incident cleanup when the adversary is no longer active; use eradication procedures instead.
Common Misconfigurations & Verification
Partial containment tips off the adversary: isolating one host or blocking one C2 IP while the actor holds Domain Admin and three other beacons lets them detect the response and detonate (ransomware) or burrow deeper. Scope the full compromise first, then contain compromised hosts, accounts, and all C2 channels in one coordinated action.
Power-off destroys evidence: pulling the plug or shutting down wipes RAM (fileless payloads, injected code, encryption keys) and breaks chain of custody. Prefer EDR network-isolation that keeps the host powered and the agent reachable; reserve power-off for active mass-destruction you cannot otherwise stop.
Credential containment that misses Kerberos: disabling accounts and resetting passwords does NOT invalidate existing Kerberos tickets or golden tickets. If Tier-0/DA is compromised you must double-reset KRBTGT (twice, ~12h apart) or the attacker re-authenticates at will. Disable accounts, don't delete (preserve the audit trail).
Persistence beyond the known account: check for additional service accounts, scheduled tasks, and implants on non-EDR/legacy hosts before declaring contained.
Verify containment actually held: confirm C2 beacons have ceased from every host (not just isolated ones), confirm disabled creds now produce 4625 failures with no new successes, confirm isolated hosts are unreachable from adjacent subnets, watch honeypot/canary accounts for adversary attempts to break out, and confirm the KRBTGT second reset completes — re-validate rather than assuming the first round worked.
Prerequisites
Confirmed incident classification with P1 or P2 severity from triage
EDR console access with host isolation capabilities (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne)
Network firewall and switch management access for segmentation
Active Directory or identity provider administrative access for credential actions
Pre-approved containment authority documented in the incident response plan
Evidence preservation plan to avoid destroying forensic artifacts during containment
Workflow
Step 1: Assess Containment Scope
Before taking containment actions, map the full scope of compromise to avoid partial containment that alerts the adversary:
Identify all confirmed compromised hosts via EDR telemetry and SIEM correlation
Map lateral movement paths using authentication logs (Windows Event ID 4624 Type 3 and Type 10)
Identify all compromised credentials (check for pass-the-hash, Kerberoasting, DCSync activity)
Block C2 IP addresses and domains at perimeter firewall and internal DNS
Implement microsegmentation rules to prevent communication between compromised hosts
Sinkhole C2 domains at internal DNS to capture connection attempts from undiscovered implants
Identity Containment:
Disable compromised user accounts in Active Directory (do not delete; preserve audit trail)
Reset passwords for all compromised accounts
Revoke active sessions and tokens (Azure AD: Revoke-AzureADUserAllRefreshToken)
Disable the compromised service account and rotate its credentials
If Domain Admin is compromised: double-reset the KRBTGT password (reset twice, 12 hours apart)
Endpoint Containment:
Use EDR to terminate malicious processes on contained hosts
Block known malicious hashes in EDR prevention policy
Quarantine identified malware samples
Disable remote services (WinRM, RDP, SMB) on critical servers not yet compromised
Step 3: Execute Long-Term Containment
Implement sustainable containment while the investigation continues:
Create network ACLs isolating the compromised VLAN/subnet while allowing business-critical traffic
Deploy temporary jump hosts for administrators to access contained systems for investigation
Implement enhanced monitoring (full packet capture) on network segments adjacent to compromised hosts
Enable advanced audit policies on all domain controllers (4768, 4769, 4771 for Kerberos attacks)
Deploy canary tokens and honeypot accounts to detect adversary attempts to expand from containment
Step 4: Validate Containment Effectiveness
Confirm that containment measures have stopped adversary operations:
Monitor for new C2 callbacks from any internal host to known adversary infrastructure
Check for new lateral movement attempts (failed authentication from disabled accounts)
Verify that contained hosts cannot reach the internet except through the EDR agent
Confirm that compromised credentials produce authentication failures
Review SIEM for any new alerts matching the adversary's known TTPs
Containment Validation Checklist:
[x] C2 beacon traffic ceased from all known compromised hosts
[x] Disabled accounts producing expected 4625 failure events (no new successes)
[x] Contained hosts unreachable via network scan from adjacent subnets
[x] No new hosts exhibiting IOCs from the initial compromise
[x] Honeypot account has not been accessed (adversary may be dormant)
[ ] Full packet capture running on finance VLAN (pending switch config)
Step 5: Preserve Evidence During Containment
Containment must not destroy forensic evidence:
Capture memory dumps from compromised hosts before any remediation (use WinPmem or Magnet RAM Capture)
Microsoft Defender for Endpoint: Live response console for remote containment actions and evidence collection
Palo Alto Networks NGFW: Application-aware firewall rules for C2 traffic blocking and microsegmentation
Velociraptor: Open-source endpoint monitoring and response tool for artifact collection during containment
BloodHound: Active Directory attack path mapping to identify potential lateral movement routes the adversary may exploit
Common Scenarios
Scenario: Ransomware Lateral Propagation via SMB
Context: EDR alerts on three file servers showing rapid file encryption. The ransomware is spreading via SMB using a compromised domain service account.
Approach:
Immediately isolate all three file servers via EDR network containment
Disable the compromised service account in Active Directory
Block SMB (TCP 445) between all server VLANs at the network switch layer
Deploy an emergency GPO disabling the SMB server service on non-critical endpoints
Capture memory from one encrypted server before it reboots
Search for the ransomware binary hash across all endpoints using EDR threat hunting
Pitfalls:
Shutting down servers immediately, destroying volatile memory evidence
Only disabling the known compromised account without checking for other persistence mechanisms
Restoring from backup before confirming the adversary's access has been fully revoked
Output Format
CONTAINMENT STATUS REPORT
=========================
Incident: INC-2025-1547
Status: CONTAINED (Short-Term)
Timestamp: 2025-11-15T15:47:00Z
Containment Lead: [Name]
ACTIONS TAKEN
Network:
- [x] 5 hosts isolated via CrowdStrike containment
- [x] C2 IP 185.220.x.x blocked at perimeter FW (rule #4521)
- [x] C2 domain evil.example[.]com sinkholed to 10.0.0.99
Identity:
- [x] jsmith account disabled
- [x] svc-backup account disabled, password rotated
- [x] admin-tier0 account disabled
- [x] KRBTGT first reset completed at 15:30 UTC
Endpoint:
- [x] Malicious hash blocked in EDR prevention policy
- [x] Malware processes terminated on all contained hosts
EVIDENCE PRESERVED
- Memory dumps: 3 of 5 hosts completed
- Event logs exported: all 5 hosts
- Network capture: running on finance VLAN
REMAINING RISKS
- Possible undiscovered implants on non-EDR endpoints (15 legacy hosts)
- KRBTGT second reset pending (scheduled 03:30 UTC +1 day)
- Adversary may have exfiltrated data before containment
BUSINESS IMPACT
- Finance file share offline (affects 42 users)
- 3 user workstations isolated (users reassigned to loaners)
- Estimated restoration: pending eradication completion
