Question

A SOC analyst receives an alert that a networked smart thermostat (an embedded Linux IoT device) in a corporate facility is beaconing to an unfamiliar external IP over an encrypted channel. The device has no traditional EDR agent, limited storage, and a read-only firmware partition. The analyst must begin investigating the potential endpoint intrusion. Given the platform constraints, what is the MOST appropriate first investigative step?

Accepted Answer

Capture and analyze network traffic to and from the device from a mirrored switch port or upstream tap

Answer

Install a lightweight EDR agent on the thermostat to collect process and file telemetry

Answer

Perform a full forensic disk image of the device's read-only firmware partition

Answer

Immediately reflash the firmware to a known-good image to remove any implant