Question

During an enterprise incident, the SOC contained a compromised workload by isolating the affected host and rebuilding it from a golden image. Within 48 hours, the same malware family reappears on the rebuilt host and two adjacent servers. Endpoint telemetry shows the initial detection was a dropper, but the reinfection has no matching download event. Which action would most effectively prevent further reinfection during the eradication phase?

Accepted Answer

Hunt for and remove persistence mechanisms across the environment—scheduled tasks, service accounts, GPOs, and startup entries—before restoring hosts

Answer

Re-image the three affected hosts again from the same golden image and re-enable them on the production network

Answer

Increase EDR sensitivity thresholds and add the malware hash to the blocklist across all endpoints

Answer

Restore the affected servers from the most recent backup taken before the initial detection