Question

During a confirmed compromise of a Compute Engine VM, a SecOps SOAR playbook has already isolated the instance and killed the malicious cron-based backdoor process. Before the playbook transitions the case to the recovery/restore phase, the incident response lead wants to ensure the threat is fully eradicated and will not reactivate. Which action should the playbook perform next to best support this goal?

Accepted Answer

Enumerate and validate all persistence mechanisms (cron entries, startup scripts, systemd units, SSH keys, service accounts) across the host, removing any attacker-planted artifacts before proceeding.

Answer

Immediately restore the VM from the most recent snapshot and return it to production to minimize downtime.

Answer

Close the case as remediated since the malicious process is no longer running and the host is isolated.

Answer

Push an updated detection rule to the tenant to alert if the same backdoor process spawns again in the future.