hard20 pts · first answer countsincident-responseedrransomware

First move on an encrypting host

EDR shows a file server actively encrypting files and talking to an unknown external IP. What is generally the best first containment action?

A.Immediately power off the server by pulling the plugB.Pay the ransom quickly to stop the encryptionC.Wait and watch for 24 hours to collect more evidenceD.Network-isolate the host using EDR (keeping it powered on), disable the compromised accounts, and preserve memory and logs

Discussion 0

Join free to post in the discussion.

First move on an encrypting host

Discussion 0

Related questions