Containment Strategy
The containment spectrum from passive monitoring to full shutdown, why containing too visibly can trigger destructive payloads, evidence preservation inside the containment decision, and when to call in an external IR firm before taking any action.
Your threat hunting team finds a Cobalt Strike beacon on a finance workstation at 2 PM on a Tuesday. The beacon has been active for 18 days. There's evidence of lateral movement to two servers. The attacker is clearly still active — there was a command run 4 hours ago. Option A: isolate all three hosts right now. Option B: monitor for 2 more hours to understand the full scope before acting. Option A risks triggering a "dead man's switch" ransomware payload the attacker may have pre-staged if they lose their beacon. Option B risks giving the attacker 2 more hours to steal data or deploy ransomware on their own schedule. There is no risk-free choice — but understanding the containment spectrum means you make the choice intentionally, not reactively.
The Containment Spectrum
Containment is not binary. Every action on the spectrum has different tradeoffs between speed, evidence preservation, attacker awareness, and business impact.
Containment Spectrum
═══════════════════════════════════════════════════════════════════
← Less disruptive More disruptive →
← Attacker less aware Attacker aware →
← Slower to stop damage Faster to stop damage →
Monitor only Selective Network block Host isolation Full shutdown
(passive) block (firewall/DNS) (EDR) (power off)
│ │ │ │ │
Full visibility Block specific Block C2 IP/ Machine can't Machine gone —
maintained C2 domain or domain at reach anything lost all volatile
No disruption IP — others perimeter — except EDR evidence
Evidence intact still live host still runs mgmt channel
When to use each:
Monitor only: Scope is unclear; attacker is not actively causing damage;
intelligence value of observation outweighs risk
Selective block: C2 channel identified; want to prevent callbacks
without alerting attacker to full IR awareness
Network block: Active data exfiltration; prevent spread; preserve
host for forensics; attacker likely aware soon
Host isolation: Confirmed destructive activity; active ransomware;
clear and present spread risk
Full shutdown: Last resort — live electrical safety, active hardware
damage threat, or court order. Always discuss with legal
first — shutdown destroys volatile evidence.
Attacker-Aware Containment
An attacker who realizes they've been detected may take immediate action: deploy ransomware pre-staged on compromised hosts, delete data, destroy logs, or create new persistence before you cut them off. Understanding when they become aware changes the containment sequence.
| Trigger | Attacker likely detects it? | Risk of reaction |
|---|---|---|
| EDR host isolation (network cut) | Yes — beacon stops calling home | High — if they're monitoring beacon health, they know within minutes |
| Password reset for compromised account | Yes — any active session using that account fails | High — they lose access, may trigger pre-positioned payloads on other hosts |
| AD account disable | Yes — same as password reset | High |
| Blocking C2 IP at perimeter firewall | Maybe — beacon connection fails, but the attacker needs to notice | Medium — depends on C2 infrastructure monitoring |
| DNS sinkhole for C2 domain | Maybe — beacon resolves to sinkhole instead of real C2 | Medium |
| Collecting EDR telemetry / memory image | No — purely read operations | Negligible — safe to do without alerting |
| Searching SIEM for IOCs across fleet | No | Negligible |
Ransomware operators typically pre-stage the ransomware binary on every compromised host weeks before deployment. When they detect IR activity, they run the deploy script immediately — hitting every host at once to maximize damage before they're fully evicted. If you contain host A without having scoped the full blast radius, hosts B through Z deploy ransomware 20 minutes later. The discipline is: understand the full scope before cutting off anything. Even in the active adversary case, a controlled 30-60 minute scope-and-simultaneous-contain sequence beats a sequential "contain what we find" approach that triggers mass deployment.
Simultaneous vs Sequential Containment
When you contain, contain everything at once. Sequential containment — isolating host A, then host B, then host C — gives the attacker time to move after each isolation.
Sequential vs Simultaneous Containment
═══════════════════════════════════════════════════════════════════
Sequential (WRONG for active adversary):
T+00:00 Isolate HOST-A (beacon dies)
T+00:05 Attacker notices HOST-A beacon is down
T+00:10 Attacker moves from HOST-B to HOST-C (new host not yet known)
T+00:15 Isolate HOST-B
T+00:20 Isolate HOST-C
Result: HOST-D and HOST-E (new lateral moves) now compromised
Simultaneous (CORRECT):
T+00:00 Preparation — identify ALL confirmed compromised hosts
T+00:30 Brief all IR team members on their specific isolation tasks
T+00:31 Simultaneous execution — all hosts isolated at the same second
(EDR bulk isolation OR coordinated multi-person action)
T+00:31 Attacker loses all beacons simultaneously
Result: All known compromised hosts isolated before attacker reacts
Bulk EDR isolation:
CrowdStrike: Bulk action on host group → Network Contain
SentinelOne: Multi-select → Network Quarantine
MDE: Device groups → Initiate machine isolation (bulk)
Short-Term vs Long-Term Containment
Initial containment stops the bleeding. Long-term containment prevents re-compromise after eradication. Both are required.
| Short-term containment | Long-term containment | |
|---|---|---|
| Goal | Stop active damage immediately | Prevent recurrence while investigation continues |
| Timing | First minutes to hours | After initial scoping, during eradication and into recovery |
| Actions | Host isolation, account disable, C2 block at firewall/DNS | Patch initial access vector, implement network segmentation, credential rotation, MFA enforcement |
| Risk | Attacker awareness, destroyed evidence, business disruption | Incomplete implementation leaves re-entry path open |
When to Call External IR Before Acting
Some incidents benefit from engaging external IR expertise before taking any containment action — because the external firm brings tools, experience with this specific attacker, and legal protections that in-house teams lack.
| Indicator | Why it suggests external IR engagement first |
|---|---|
| Suspected nation-state or advanced APT | Attribution and intelligence requires specialized threat intel. Wrong containment sequence against sophisticated actors can trigger pre-staged destructive payloads. |
| Data exfiltration confirmed or suspected | External counsel engagement triggers attorney-client privilege over the investigation report. IR firm hired by counsel produces privileged findings. |
| Ransomware at scale (>50 hosts) | Ransomware negotiation and recovery requires specialized expertise. External firms have decryption key negotiation experience and relationships. |
| Internal team capacity exceeded | A 2-person SOC cannot work a 200-host ransomware incident. External surge capacity prevents the team from burning out and missing critical evidence. |
| Board or regulatory scrutiny expected | External IR report carries more credibility with regulators than internal self-investigation findings. |
Organizations typically call external IR 12-24 hours into a P1 incident, after the internal team is exhausted and has already made several containment decisions that closed forensic avenues. The IR retainer exists precisely to be called at T+0 — as soon as P1 is declared, call the retainer hotline. The external firm can shadow the internal team while they scope, provide advice before containment decisions are made, and be ready to take over scale if needed. Calling at T+0 does not mean handing over control — it means having expert backup available before it's urgently needed.
Q & A
Q: How do you isolate a host while preserving the management channel for evidence collection?
EDR isolation (network containment) cuts all network connectivity except the EDR management channel — this is the feature specifically designed for this use case. CrowdStrike Network Containment allows the Falcon sensor to continue communicating with the cloud console while blocking all other traffic. You can still collect artifacts, run response actions, and pull files through the EDR console from a fully contained host. If your EDR doesn't support this (unlikely for modern EDRs), the alternative is a firewall rule that blocks all traffic except your forensic collection server's IP before you cut the default gateway — but this requires pre-planning the collection infrastructure's IP address.
Q: The attacker is still connected via RDP. Do you kill the session?
Not immediately. A live attacker session is an intelligence opportunity — you can observe commands they run, understand their objectives, and potentially identify additional scope before they realize they're being watched. The tradeoff is risk: while you observe, they may be exfiltrating data or installing persistence. The decision depends on: (1) Do you have complete scope understanding already? If yes, contain. (2) Are they actively causing damage (deleting files, encrypting, exfiltrating in high volume)? If yes, contain immediately. (3) Are they in exploration/recon mode? Then controlled observation for a short window may be worth the risk. Document the decision and the reasoning — this is the kind of judgment call that gets reviewed later.
Q: Leadership is demanding all systems come back online immediately. You're in the middle of containment. How do you handle this?
This is a business-risk decision that requires authority above the IR lead. The right response is: "I understand the business pressure. Bringing systems online before eradication is complete creates a high probability of immediate re-compromise and a second, longer outage. I need 15 minutes to brief you on the specific risks. If leadership still decides to prioritize availability over security posture, I need that decision in writing with authorization from [CISO/CIO/CEO] because it overrides the IR protocol we have in place." Do not comply with the request unilaterally — both because it creates re-compromise risk and because if it goes wrong, you need a record that the decision was made at the appropriate authority level, not by the IR team under pressure.