Question

A security team discovers that a containerized application running on Amazon ECS with the Fargate launch type has been compromised. The task is actively communicating with a known command-and-control server. The team must contain the specific task for later forensic analysis while minimizing disruption to other healthy tasks in the same service, and they need to preserve as much volatile evidence as possible. Which containment approach best meets these requirements?

Accepted Answer

Update the task's security group to deny all egress traffic while leaving the task running, then use ECS Exec to capture in-memory artifacts before stopping it.

Answer

Stop the ECS service entirely and set its desired count to zero so no tasks continue running.

Answer

Terminate the underlying EC2 host that the Fargate task is running on to immediately kill the malicious process.

Answer

Delete the task definition so that no new tasks can be launched from the compromised image.