| name | cyber-containing-active-breach |
| description | Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat |
| source | mukul975/Anthropic-Cybersecurity-Skills |
| license | Apache-2.0 |
| authorized_lab | false |
| origin_frontmatter | name: containing-active-breach | description: 'Executes containment strategies to stop active adversary operations | and prevent lateral movement during a confirmed security breach. Implements short-term | and long-term containment using network segmentation, endpoint isolation, credential | revocation, and access control modifications. Activates for requests involving breach | containment, lateral movement prevention, network isolation, active threat containment, | or live incident re |
| hide | true |
Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.
Containing Active Breaches
When to Use
- A confirmed intrusion is in progress with an active adversary on the network
- Malware is spreading laterally across endpoints or servers
- A compromised account is being used for unauthorized access to systems
- Ransomware encryption has been detected and is actively propagating
- An attacker has established command-and-control communications from internal hosts
Do not use for post-incident cleanup when the adversary is no longer active; use eradication procedures instead.
Prerequisites
- Confirmed incident classification with P1 or P2 severity from triage
- EDR console access with host isolation capabilities (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne)
- Network firewall and switch management access for segmentation
- Active Directory or identity provider administrative access for credential actions
- Pre-approved containment authority documented in the incident response plan
- Evidence preservation plan to avoid destroying forensic artifacts during containment
Workflow
Step 1: Assess Containment Scope
Before taking containment actions, map the full scope of compromise to avoid partial containment that alerts the adversary:
- Identify all confirmed compromised hosts via EDR telemetry and SIEM correlation
- Map lateral movement paths using authentication logs (Windows Event ID 4624 Type 3 and Type 10)
- Identify all compromised credentials (check for pass-the-hash, Kerberoasting, DCSync activity)
- Determine C2 channels (beacon intervals, domains, IPs, protocols)
- Assess whether the adversary has domain admin or equivalent privileges
Containment Scope Assessment:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Compromised Hosts: 5 (WKSTN-042, WKSTN-087, SRV-FILE01, SRV-DC02, WKSTN-103)
Compromised Accounts: 3 (jsmith, svc-backup, admin-tier0)
C2 Channels: HTTPS beacon to 185.220.x.x every 60s ± 15% jitter
Lateral Movement: PsExec via svc-backup, RDP via admin-tier0
Adversary Privilege: Domain Admin (admin-tier0 compromised)
Data at Risk: Finance share (\\SRV-FILE01\finance$) accessed
Step 2: Execute Short-Term Containment
Implement immediate actions to stop adversary operations without destroying evidence:
Network Containment:
