RA3112: Isolate Asset

Summary

ID	RA3112
Brief Description	Isolate machine via EDR
Author	@SEC
Creation Date	2023/05/20
References	https://github.com/certsocietegenerale/IRM/blob/main/EN/IRM-2-WindowsIntrusion.pdf
Response Stage	Containment

Description

If possible, isolate the machine via EDR Or If the machine is not considered critical for your company and can be disconnected, shut the machine down the hard way, removing its power plug. If it is a laptop with a battery on, just push the “off” button for some seconds until the computer switches off.