Question

During an active incident on a Linux production database server, the responder confirms suspicious outbound connections from a process with no matching binary on disk (fileless malware indicator). The server cannot be immediately taken offline due to business impact, and legal has requested court-admissible evidence. Which action should the responder take FIRST to preserve the most probative evidence?

Accepted Answer

Capture a full volatile memory (RAM) image of the running system before any other collection steps

Answer

Shut down the server cleanly and create a bit-for-bit forensic image of the disk

Answer

Export the SIEM logs correlated to the suspicious connections and hash the export

Answer

Kill the suspicious process and quarantine the parent binary for malware analysis