Question

A SOC analyst using an EDR platform observes that a finance workstation is executing an unsigned binary that is spawning encoded PowerShell commands and initiating outbound connections to multiple external IPs. The analyst needs to stop the potential spread while preserving the ability to investigate the host and collect volatile data. Which EDR capability should the analyst invoke FIRST?

Accepted Answer

Trigger network isolation (host containment) on the workstation through the EDR console

Answer

Immediately power off the workstation to stop the malicious process

Answer

Deploy an antivirus full scan and quarantine any flagged files

Answer

Add the external IPs to the perimeter firewall blocklist