Question

During an active incident, a SecurityX analyst confirms that a threat actor has compromised a domain-joined workstation and is using stolen Kerberos tickets to authenticate laterally to file servers. The finance department is actively closing quarter-end books and their file share resides on one of the targeted servers. Leadership has authorized aggressive containment but wants business disruption minimized. Which containment action BEST limits lateral movement while preserving evidence and critical business function?

Accepted Answer

Isolate the compromised workstation at the network layer, reset the affected accounts and force a KRBTGT double-reset, and apply firewall rules restricting the file servers to known-good subnets

Answer

Immediately power off the compromised workstation and all targeted file servers to halt the attack completely

Answer

Rebuild the compromised workstation from a golden image immediately and monitor the file servers for further activity

Answer

Disable all Active Directory accounts domain-wide and require every user to re-enroll before restoring access