R. Response (contain)
Containment stops the attacker and preserves the evidence.
Cut the specific paths the attacker is using. Pulling the host stopped being a general strategy once estates went distributed. A compromised web server isolated from internal systems while it keeps serving the internet is contained, and the site is still up.
| Layer | Use it for |
|---|---|
| Network | Broad, fast control over many systems at once |
| Host | Precision on a known-compromised endpoint |
| Application | Attacker tooling that network controls do not see |
| Identity | SaaS and cloud paths, where it is frequently the only layer that reaches |
The best-known sinkhole in the field
Reporting by WIRED, TechCrunch and the Associated Press; sinkhole data published by Kryptos Logic
WannaCry, 12 May 2017. The worm was spreading across Europe and the NHS was turning patients away. Marcus Hutchins, working for Kryptos Logic from England, found an unregistered domain inside a WannaCry sample and bought it on Namecheap for $10.69, intending to sinkhole the traffic and count infected hosts. The malware checked whether that domain resolved before encrypting anything and halted when it did. Another researcher reverse-engineered the check and confirmed the behavior. Spread of that variant stopped the same afternoon.
The technique was ordinary DNS sinkholing, the same mechanism in Figure 79, applied at internet scale by accident. Hutchins told the Associated Press at the time that he was not a hero and was just doing his part to stop botnets.
It eradicated nothing. Variants with different killswitch domains appeared within days, unpatched hosts were still reaching the sinkhole years later, and Boeing, Honda, Connecticut state agencies and Victoria state police all reported infections during 2018. A sinkhole buys time to patch. The patching still has to happen.
Identity containment
| # | Item |
|---|---|
| 1 | Passwords reset at the primary identity provider, privileged accounts first |
| 2 | Service account credentials, API keys, and programmatic tokens rotated |
| 3 | Resets coordinated for accounts synced between on-premises and cloud directories |
| 4 | Active sessions and authentication tokens revoked at the identity provider |
| 5 | VPN, RDP, and SSH sessions force disconnected |
| 6 | Session token version incremented to invalidate browser sessions, where supported |
| 7 | OAuth refresh tokens and offline access tokens invalidated; stateless JWTs deny-listed where applicable |
| 8 | Authentication logs watched for token endpoint requests indicating cached credential use |
| 9 | Conditional access applied: location, device compliance, risk-based blocking, phishing-resistant MFA |
| 10 | Account disabled at the identity provider to cut every SSO-connected application at once |
| 11 | Applications using local accounts rather than the identity provider identified and revoked separately |
| 12 | OAuth-connected applications authorized by the compromised account revoked |
| 13 | Automation rules, webhooks, CI/CD deployment keys, and broad-permission browser extensions disabled |
Evidence, in this order
| # | Item |
|---|---|
| 14 | Memory first, using WinPMEM or Linpmem |
| 15 | Selective forensic images of systems holding unique evidence, such as patient zero and hosts running custom tooling |
| 16 | Logs forwarded off the host immediately so they cannot be deleted |
Validate before calling it contained
| # | Item |
|---|---|
| 17 | Network: firewall, proxy, and DNS show no C2 resuming, no new connection patterns, no protocol tunneling |
| 18 | Process: no respawned malware, no new persistence, no executables in unusual paths |
| 19 | Logs: no failed authentication bursts, no privilege escalation, no unusual file access |
- Human-operated ransomware groups have accelerated encryption after detecting defensive action, and watchdog processes respawn malware or trigger destructive payloads. Move quietly until the adversary is understood.
- Sequential isolation signals the response and gives the adversary time to escalate. Execute simultaneously across the network, endpoint, identity, and application teams.
- Write the rollback procedure before changing firewall rules or network topology. It will be requested at the worst possible time.