Incident Containment Strategies -- NIST SP 800-61 Rev 2 / MITRE ATT&CK

Frameworks: NIST SP 800-61 Rev 2 (Containment, Eradication, and Recovery), MITRE ATT&CK Enterprise Matrix Role: SOC Analyst, Security Engineer Time: 15-30 min Output: Containment plan with short-term and long-term actions, business impact trade-off analysis, ATT&CK-mapped countermeasures, and rollback criteria

---

1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

• Active incident requires isolation -- A confirmed security incident is in progress and affected systems must be contained to prevent further damage or lateral movement.
• Containment strategy selection -- The responder needs to choose between network isolation, credential revocation, DNS sinkholing, or other containment mechanisms based on incident type and business constraints.
• Business impact vs. security risk trade-off -- The containment action may disrupt business operations and the team needs a structured framework to evaluate the trade-off.
• Attacker technique requires specific countermeasure -- The identified ATT&CK technique dictates a particular containment approach (e.g., credential theft requires credential revocation, not just network isolation).
• Containment effectiveness validation -- Previous containment actions may have been insufficient and the team needs to assess and escalate containment measures.

Do not use when: The task is initial incident triage and classification (use ir-playbook), forensic evidence collection (use forensics-checklist), or post-incident review (use post-incident-review).

---

2. Context the Agent Needs

Before selecting a containment strategy, gather or confirm:

• Incident classification and severity -- From the ir-playbook assessment (category, SEV level).
• Affected systems inventory -- Hostnames, IPs, cloud resource IDs, services running on affected systems, and their business function.
• Attack vector and techniques -- Known MITRE ATT&CK techniques in use (initial access, lateral movement, persistence, C2).
• Attacker access scope -- What accounts, systems, and network segments has the attacker accessed or potentially compromised?
• Business criticality of affected systems -- Revenue impact, customer impact, SLA obligations, regulatory implications of downtime.
• Network topology -- VLANs, subnets, firewall zones, cloud VPCs, segmentation boundaries relevant to the affected systems.
• Evidence preservation status -- Has volatile evidence been captured? (Reference forensics-checklist.) Containment actions may destroy evidence if not collected first.
• Current containment state -- What actions, if any, have already been taken?

---

3. Process

Step 1: Containment Decision Criteria

NIST SP 800-61 Rev 2 (Section 3.3.1) identifies the following criteria for containment strategy selection. Evaluate each factor before choosing a containment approach:

Criterion	Question	Impact on Decision
Potential damage	How much additional damage can occur if containment is delayed?	Higher potential damage favors aggressive, immediate containment
Evidence preservation	Will the containment action destroy critical evidence?	If volatile evidence is not yet captured, delay destructive containment
Service availability	What business services will be affected by containment?	Business-critical systems may require surgical containment to minimize disruption
Resource requirements	Does the containment strategy require resources not currently available?	Choose strategies executable with available tools and personnel
Duration	How long will containment need to remain in place?	Long-duration containment must be sustainable without degrading business operations
Effectiveness	Will this containment action actually prevent further attacker activity?	Partial containment that the attacker can bypass wastes time and tips off the adversary

Containment decision matrix:

                        Business Criticality
                    Low              High
              +-----------+     +-----------+
  Threat   H  | ISOLATE   |     | SURGICAL  |
  Severity I  | Full       |     | Targeted  |
           G  | network    |     | block +   |
           H  | isolation  |     | monitor   |
              +-----------+     +-----------+
              +-----------+     +-----------+
           L  | STANDARD  |     | MONITORED |
           O  | Isolate & |     | Enhanced  |
           W  | schedule  |     | monitoring|
              | rebuild   |     | + planned |
              +-----------+     | response  |
                                +-----------+

Step 2: Short-Term Containment

Short-term containment aims to stop the immediate threat with minimal preparation. These are rapid-response actions executed within minutes to hours.

Network isolation strategies:

Strategy	Method	Use When	Limitations
Port shutdown	Disable switchport or cloud security group ingress/egress	Single host compromise, not business-critical	Disrupts all services on the host
VLAN isolation	Move host to quarantine VLAN with restricted routing	Need to maintain some connectivity for evidence collection	Requires network team coordination
Firewall rule	Block specific IPs, ports, or protocols at perimeter or host firewall	Known C2 infrastructure, specific attack vector	Attacker may use alternate C2 channels
DNS sinkholing	Redirect malicious domains to controlled IP via internal DNS	C2 communication via domain names	Ineffective if attacker uses direct IP communication
Cloud security group lockdown	Remove all inbound/outbound rules except management access	Cloud instance compromise	May disrupt dependent services
VPN/remote access revocation	Disable VPN accounts, revoke remote access tokens	Compromised remote access credentials	Disrupts legitimate remote users on same system

Credential revocation strategies:

Strategy	Method	Use When	Scope
Password reset	Force password change for compromised accounts	Credential theft confirmed or suspected	Individual accounts
Session invalidation	Revoke all active sessions and tokens for affected accounts	Session hijacking, token theft	Individual accounts
API key rotation	Generate new API keys, revoke old keys	API key exposure or misuse	Specific services
Certificate revocation	Revoke and reissue TLS/mTLS certificates	Certificate compromise, CA compromise	Services using the certificate
Service account reset	Reset service account passwords and regenerate keys	Lateral movement via service accounts	Downstream services may break
Kerberos ticket reset	Reset krbtgt account password (twice, per Microsoft guidance)	Golden ticket attack, domain compromise	Domain-wide impact; requires careful planning
MFA token reset	Deregister and re-enroll MFA devices	MFA bypass, SIM swap, device compromise	Individual users

Step 3: Long-Term Containment

Long-term containment allows the organization to maintain operations while keeping the attacker blocked. These actions prepare the environment for eradication.

Action	Description	Duration
Network segmentation enforcement	Implement or tighten firewall rules between network segments to prevent lateral movement paths the attacker used	Until eradication complete + validation
Enhanced monitoring deployment	Deploy additional logging, network capture, or EDR sensors on affected and adjacent segments	Minimum 30 days post-incident
Temporary system hardening	Apply emergency patches, disable unnecessary services, restrict administrative access to affected systems	Until full rebuild
Backup system deployment	Stand up clean replacement systems from known-good images to restore business functions while compromised systems remain isolated	Until compromised systems are eradicated and validated
DNS policy enforcement	Implement DNS filtering to block known-malicious domains and restrict DNS to internal resolvers only	Permanent improvement
Egress filtering	Restrict outbound network traffic to only approved destinations and protocols	Permanent improvement

Step 4: ATT&CK Technique-Specific Containment

Map observed attacker techniques to targeted containment actions. Each ATT&CK technique has containment actions that specifically counter the adversary's capability.

Initial Access Containment

ATT&CK Technique	Containment Action
T1566 -- Phishing	Block sender domain/IP at email gateway; quarantine delivered messages; reset credentials of users who interacted with phishing content
T1190 -- Exploit Public-Facing Application	Deploy WAF rule to block exploit pattern; take vulnerable application offline or restrict access to VPN-only; apply emergency patch
T1078 -- Valid Accounts	Disable compromised accounts; force MFA re-enrollment; review and revoke sessions; audit account activity for lateral movement
T1195 -- Supply Chain Compromise	Isolate systems running compromised software; block network communication to compromised vendor infrastructure; roll back to known-good version
T1133 -- External Remote Services	Disable compromised VPN/RDP accounts; restrict remote access to allowlisted IPs; require MFA for all remote access

Lateral Movement Containment

ATT&CK Technique	Containment Action
T1021 -- Remote Services (RDP, SSH, SMB)	Block lateral protocols between workstations; restrict admin protocols to jump servers; disable unused remote services
T1550 -- Use Alternate Authentication Material (Pass-the-Hash, Pass-the-Ticket)	Reset affected account credentials; clear Kerberos ticket caches; enable Credential Guard; restrict NTLM authentication
T1210 -- Exploitation of Remote Services	Isolate vulnerable systems; apply emergency patches; restrict network access to affected services
T1570 -- Lateral Tool Transfer	Block SMB/admin shares between endpoints; restrict PowerShell remoting; deploy application whitelisting

Command and Control Containment

ATT&CK Technique	Containment Action
T1071 -- Application Layer Protocol (HTTP/S, DNS)	Block C2 IPs/domains at firewall and proxy; implement SSL inspection for identified C2 domains; deploy DNS sinkhole
T1572 -- Protocol Tunneling	Inspect and restrict non-standard protocol usage; block unauthorized VPN/tunnel endpoints; deploy deep packet inspection
T1573 -- Encrypted Channel	Block C2 IPs at network layer (encryption prevents content inspection); deploy JA3/JA3S fingerprinting to identify C2 TLS signatures
T1568 -- Dynamic Resolution (DGA, DNS Calc)	Deploy DNS analytics to detect DGA patterns; restrict DNS to internal resolvers; implement DNS response policy zones (RPZ)

Persistence Containment

ATT&CK Technique	Containment Action
T1053 -- Scheduled Task/Job	Audit and remove unauthorized scheduled tasks; restrict task creation permissions; monitor task scheduler logs
T1547 -- Boot or Logon Autostart Execution	Audit startup entries (Run keys, startup folders, systemd units); restrict write access to autostart locations
T1505.003 -- Web Shell	Scan web-accessible directories for unauthorized files; deploy file integrity monitoring; restrict write permissions on web roots
T1136 -- Create Account	Audit and disable unauthorized accounts; restrict account creation permissions; alert on new account creation

Step 4b: Wiper / Destructive Malware Containment

Wiper and destructive malware require a distinct containment approach from ransomware or standard malware. The goal shifts from "stop encryption and preserve data" to "stop destruction and protect remaining systems," since wiped data is irrecoverable.

Containment priorities (in order):

1. Immediate network segmentation -- Disconnect affected segments at the switch/router level. Wiper propagation via SMB (T1021.002), WMI (T1047), or Group Policy (T1484.001) must be severed before forensic triage.
2. Preemptive shutdown of unaffected systems -- If the wiper propagation vector is unknown, power off systems that have not yet been hit. A wiper that has not triggered yet is stopped by a cold shutdown. This is the opposite of ransomware guidance (where you keep systems on for memory forensics).
3. Protect backup infrastructure -- Verify offline/immutable/air-gapped backups are intact. Disconnect backup agents and NAS/SAN replication from the network. Wipers frequently target backup systems (Volume Shadow Copies, vCenter, backup catalogs).
4. Block propagation protocols -- Emergency firewall rules to block SMB (445), WMI (135/5985/5986), RDP (3389), and PsExec/admin shares between all endpoints. Allow only from designated jump servers.
5. Disable compromised service accounts -- Wiper deployment often uses compromised domain admin or service accounts. Disable all accounts showing anomalous activity; reset krbtgt if domain compromise is suspected.

ATT&CK techniques specific to wiper malware:

ATT&CK Technique	Description	Containment Action
T1485 -- Data Destruction	Overwrite or delete data on local and remote drives	Isolate affected systems; power off systems not yet hit; verify backup integrity
T1490 -- Inhibit System Recovery	Delete Volume Shadow Copies, disable Windows Recovery, destroy backup catalogs	Disconnect backup infrastructure from network; verify offline backup integrity
T1561.001 -- Disk Wipe: MBR	Overwrite Master Boot Record to prevent boot	Power off unaffected systems; preserve one affected disk for forensics
T1561.002 -- Disk Wipe: Content	Overwrite or corrupt file content across volumes	Network segmentation to prevent spread; emergency shutdown of at-risk systems
T1047 -- WMI	Remote execution of wiper payload via WMI	Block WMI ports (135, 5985, 5986); disable WinRM on endpoints
T1484.001 -- Domain Policy Modification: GPO	Deploy wiper via Group Policy push	Disconnect domain controllers from network if GPO deployment confirmed

Key difference from ransomware containment: Do not attempt to "monitor and observe" a wiper in progress. Every second of observation is data permanently destroyed. Aggressive, immediate containment is always the correct posture for confirmed wiper activity.

Step 5: Containment Validation

After implementing containment, verify effectiveness before proceeding to eradication.

Validation checklist:

Check	Method	Expected Result
C2 communication blocked	Monitor network traffic for C2 indicators	No outbound connections to known C2 IPs/domains
Lateral movement blocked	Monitor authentication logs and network flows between segments	No unauthorized cross-segment authentication
Compromised credentials revoked	Attempt authentication with known-compromised credentials	Authentication fails
Attacker persistence neutralized	Scan for known persistence mechanisms	No active persistence artifacts
Business services operational (if surgical containment)	Verify critical service health checks	Services responding normally
Evidence preserved	Verify forensic images and memory dumps are intact and hashed	Hash verification passes

Containment failure indicators:

• New C2 connections from previously unknown infrastructure
• New compromised accounts appearing after credential reset
• Attacker activity from systems outside the containment perimeter
• New persistence mechanisms deployed after containment actions

If containment fails, escalate to full network isolation and engage external incident response support.

Step 6: Rollback Criteria

Define conditions under which containment actions should be rolled back or modified:

Condition	Rollback Action	Approval Required
Containment causes unacceptable business disruption exceeding incident impact	Reduce to surgical containment with enhanced monitoring	Incident Commander + Business Owner
Forensic investigation requires attacker communication to continue (controlled observation)	Relax network blocks under monitored conditions with legal approval	Incident Commander + Legal + CISO
Containment action was applied to wrong scope (false positive)	Remove containment controls from unaffected systems	Incident Commander
Eradication complete and validated	Phase out containment controls in stages with monitoring	Incident Commander + Security Team

---

4. Findings Classification

Severity	Label	Definition	Containment Posture
P0	Critical	Active attacker with data exfiltration or destructive capability in progress	Immediate full isolation. Sacrifice availability for security.
P1	High	Confirmed compromise with lateral movement capability or access to sensitive data	Short-term containment within 1 hour. Surgical if business-critical.
P2	Medium	Confirmed compromise, limited scope, no evidence of lateral movement or data access	Standard containment within 4 hours. Evidence preservation first.
P3	Low	Suspicious activity, unconfirmed compromise, limited indicators	Enhanced monitoring. Prepare containment actions for rapid deployment.
P4	Informational	Reconnaissance or scanning activity with no confirmed compromise	Log and monitor. Update detection rules.

---

5. Output Format

Produce the containment plan with these exact sections:

## Containment Plan: [Incident ID]
**Date:** [YYYY-MM-DD]
**Skill:** containment v1.0.0
**Frameworks:** NIST SP 800-61 Rev 2, MITRE ATT&CK
**Incident Commander:** [Name]

### Containment Summary
[2-3 sentences. State the containment strategy selected, rationale based on
threat severity and business criticality, and expected impact on operations.]

### Decision Criteria Assessment
| Criterion | Assessment | Weight |
|---|---|---|
| Potential damage if uncontained | [Assessment] | [High/Medium/Low] |
| Evidence preservation impact | [Assessment] | [High/Medium/Low] |
| Service availability impact | [Assessment] | [High/Medium/Low] |
| Resource requirements | [Assessment] | [High/Medium/Low] |
| Expected containment duration | [Assessment] | [Hours/Days/Weeks] |
| Containment effectiveness | [Assessment] | [High/Medium/Low] |

### Short-Term Containment Actions
| Action | Target | ATT&CK Technique Countered | Status | Owner | ETA |
|---|---|---|---|---|---|
| [Action] | [System/Account/Network] | [T-code] | [Planned/In Progress/Complete] | [Name] | [Time] |

### Long-Term Containment Actions
| Action | Target | Duration | Status | Owner |
|---|---|---|---|---|
| [Action] | [Scope] | [Duration] | [Planned/In Progress/Complete] | [Name] |

### Business Impact Assessment
| Service/System | Impact of Containment | Mitigation | Acceptable |
|---|---|---|---|
| [Service] | [Description of disruption] | [Workaround if any] | [Yes/No -- requires escalation] |

### Containment Validation Checklist
| Check | Result | Timestamp |
|---|---|---|
| [Validation item] | [Pass/Fail/Pending] | [timestamp] |

### Rollback Conditions
[Document specific conditions under which containment will be modified or rolled back]

### Escalation Path
[Document next steps if containment proves insufficient]

---

6. Framework Reference

NIST SP 800-61 Rev 2 -- Containment, Eradication, and Recovery

NIST SP 800-61 Rev 2 Section 3.3 defines containment as the first priority after an incident is detected and analyzed. Key principles:

• Containment strategy depends on incident type. Different categories of incidents (malware, unauthorized access, DoS) require fundamentally different containment approaches. A strategy that works for network-based attacks (firewall rules) may be ineffective against insider threats (credential-based attacks).

• Containment provides time. The primary purpose of containment is to limit damage and provide the IR team time to develop a complete remediation strategy. Containment is not eradication -- the attacker's access may still exist in a degraded form.

• Evidence must be considered. NIST explicitly states that containment strategies should account for evidence preservation needs. Some containment actions (shutting down a system, wiping and reimaging) destroy volatile evidence that may be critical for understanding the full scope of compromise.

• Criteria for strategy selection. NIST identifies potential damage to resources, need for evidence preservation, service availability, time and resources needed, effectiveness of the strategy, and duration of the solution as the key factors for choosing a containment approach.

MITRE ATT&CK -- Mapping Techniques to Containment

MITRE ATT&CK provides a taxonomy of adversary techniques organized by tactical objective. For containment purposes, the most relevant tactic categories are:

• Lateral Movement (TA0008) -- Techniques the attacker uses to move through the network. Containment must block these paths: RDP, SSH, SMB, WMI, Pass-the-Hash, exploitation of remote services.
• Command and Control (TA0011) -- Techniques for communicating with compromised systems. Containment must sever C2 channels: HTTP/S beaconing, DNS tunneling, encrypted channels, domain fronting.
• Persistence (TA0003) -- Techniques for maintaining access across reboots and credential changes. Containment must identify and neutralize persistence mechanisms to prevent re-compromise after eradication.
• Exfiltration (TA0010) -- Techniques for stealing data. Containment must block exfiltration channels, which may differ from C2 channels.

Mapping each observed technique to its ATT&CK identifier enables targeted containment that addresses the specific attacker capability rather than applying generic network isolation that may be insufficient or overly disruptive.

---

7. Common Pitfalls

Pitfall 1: Containing Too Narrowly and Missing Lateral Movement

Isolating only the initially compromised system while the attacker has already moved to other systems creates a false sense of containment. The attacker continues operating from uncontained systems while the IR team focuses on the decoy. Before implementing containment, assess the full scope of compromise -- check authentication logs, network flows, and EDR telemetry for evidence of lateral movement to other systems.

Pitfall 2: Tipping Off the Attacker with Visible Containment Actions

Blocking a single C2 channel, resetting one compromised account, or removing one persistence mechanism signals to the attacker that they have been detected. A sophisticated attacker with multiple access paths will immediately switch to alternate channels, escalate privileges, or deploy destructive payloads. When facing an advanced threat, coordinate containment actions for simultaneous execution across all known attacker footholds rather than implementing them incrementally.

Pitfall 3: Choosing Full Isolation When Surgical Containment Is Appropriate