<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: containing-active-breach
description: >-
  Executes containment strategies to isolate compromised systems, disable threat actor
  access, and prevent lateral movement during an active security breach.
domain: cybersecurity
subdomain: incident-response
tags:
  - containment
  - breach-response
  - network-isolation
  - lateral-movement
  - account-lockout
  - EDR
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Containing an Active Breach

## Overview

Containment is the most time-critical IR phase — the window between detection and
containment determines blast radius. Effective containment isolates compromised
systems, revokes threat actor access, and blocks lateral movement pathways without
destroying volatile evidence. The principle: contain fast, but preserve evidence.

Three containment tiers operate simultaneously: network isolation (block C2 and
lateral paths), identity containment (disable compromised accounts), and endpoint
containment (quarantine hosts via EDR).

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| EDR console | Endpoint isolation | CrowdStrike / Defender / S1 |
| Firewall access | Network segmentation | Palo Alto / Fortinet / iptables |
| Active Directory | Account management | RSAT / PowerShell AD module |
| DNS sinkhole | Block C2 domains | Pi-hole / Infoblox / BIND |
| SOAR platform | Automated containment | Cortex XSOAR / Splunk SOAR |

## Key Concepts

### Containment Decision Matrix

| Factor | Short-term Containment | Long-term Containment |
|--------|----------------------|----------------------|
| Timeline | Minutes to hours | Hours to days |
| Goal | Stop active bleeding | Rebuild trust boundaries |
| Network | Block C2, isolate hosts | Segment network, new ACLs |
| Identity | Disable accounts | Rotate all credentials |
| Evidence | Preserve before action | Full forensic copy |

### Blast Radius Assessment

Before containment, assess:
- Number of compromised endpoints
- Compromised accounts and privilege levels
- Data accessed or exfiltrated
- Persistence mechanisms installed
- C2 channels active

### Evidence Preservation Rule

**ALWAYS capture volatile evidence before containment actions that may alter system state.**
Network isolation via EDR preserves the endpoint. Account disabling does not destroy evidence.
System shutdown destroys volatile evidence — avoid unless absolutely necessary.

## Workflow

### Step 1 — Assess Scope

```bash
# Identify all systems communicating with known C2
tshark -r capture.pcap -Y "ip.dst == $C2_IP" -T fields -e ip.src | sort -u

# Search EDR for lateral movement indicators
# CrowdStrike threat graph query
curl -s -X POST "https://api.crowdstrike.com/threatgraph/queries/edge-connections/v1" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"scope":"device","value":"DEVICE_ID"}'
```

### Step 2 — Network Containment

```bash
# Block C2 IPs at perimeter firewall
iptables -I FORWARD -d $C2_IP -j DROP
iptables -I FORWARD -s $C2_IP -j DROP
iptables -I OUTPUT -d $C2_IP -j DROP

# DNS sinkhole for C2 domains
echo "address=/$C2_DOMAIN/127.0.0.1" >> /etc/dnsmasq.d/sinkhole.conf
systemctl restart dnsmasq

# Isolate VLAN at switch level
# (specific to network equipment — example Cisco)
# interface GigabitEthernet0/1
#   switchport access vlan 999
```

### Step 3 — Endpoint Containment

```bash
# CrowdStrike — isolate host (maintains EDR telemetry)
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"ids":["DEVICE_ID"]}'

# Microsoft Defender — isolate machine
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/$MACHINE_ID/isolate" \
  -H "Authorization: Bearer $MDE_TOKEN" \
  -d '{"Comment":"IR containment","IsolationType":"Full"}'

# Linux — host-level firewall (allow SSH from IR jump box only)
iptables -F
iptables -A INPUT -s $IR_JUMPBOX_IP -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -d $IR_JUMPBOX_IP -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -j DROP
```

### Step 4 — Identity Containment

```powershell
# Disable compromised accounts
Disable-ADAccount -Identity "compromised_user"

# Force password reset
Set-ADAccountPassword -Identity "compromised_user" -Reset -NewPassword (ConvertTo-SecureString "TempP@ss!" -AsPlainText -Force)
Set-ADUser -Identity "compromised_user" -ChangePasswordAtLogon $true

# Revoke active sessions (Azure AD)
Revoke-AzureADUserAllRefreshToken -ObjectId $USER_OBJECT_ID

# Invalidate Kerberos tickets
# Reset krbtgt twice (with 12-hour gap) for Golden Ticket remediation
Reset-KrbtgtPassword -Domain "corp.example.com"

# Disable service accounts used by attacker
Get-ADServiceAccount -Filter {Name -like "svc_*"} | Disable-ADAccount
```

### Step 5 — Monitor Containment Effectiveness

```bash
# Verify no active C2 connections
ss -tnp | grep "$C2_IP"

# Verify host isolation
ping -c 3 $CONTAINED_HOST  # Should fail

# Monitor for containment bypass attempts
tail -f /var/log/firewall.log | grep -i "denied\|blocked"
```

### Step 6 — Document Containment Actions

Record every containment action with timestamp, executor, and justification.
This forms part of the IR timeline and legal documentation.

## Detection

```yaml
title: Containing Active Breach Detection
id: 112fe0a6-7a98-45e3-ad95-60fe498d26d3
status: experimental
description: Detects suspicious activity related to containing active breach techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*containing*active*"
  condition: selection
level: high
tags:
  - attack.t1021
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] All known C2 IPs/domains blocked at network perimeter
- [ ] Compromised endpoints isolated via EDR (telemetry still flowing)
- [ ] Compromised accounts disabled and sessions revoked
- [ ] Volatile evidence captured before destructive containment
- [ ] Lateral movement paths blocked (segmentation, ACLs)
- [ ] Containment bypass monitoring active
- [ ] All actions logged with timestamps in IR case management
- [ ] Business stakeholders notified of service impact

## References

- NIST SP 800-61r3: Containment, Eradication, and Recovery
- SANS Incident Handler's Handbook: Containment Phase
- CrowdStrike Falcon API: Host Containment
- Microsoft Defender API: Machine Isolation
- MITRE ATT&CK: Lateral Movement (TA0008)
