Choose the first containment move on a beaconing jump box
Pick an initial containment action for a likely-compromised privileged host by weighing spread risk against evidence loss.
PRIVILEGED HOST SCENARIO A jump box with admin reach is beaconing to an external IP. No encryption event yet, but domain-controller access is possible. What is the strongest first move? Network-isolate the host, preserve memory and active connections, and revoke any in-use privileged sessions. Strong move. You cut the most dangerous access path while preserving the evidence that tells you whether the intrusion is broader. Power the host off immediately to make sure the attacker cannot keep working. Fast but costly. You may stop the beacon, but you also destroy the volatile evidence that would show process state, active sessions,…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in