Containing lateral movement checklist
Overview
Lateral movement uses stolen credentials, RMM, WMI, PSRemoting, or trust relationships. Containment must segment without bricking production.
Identity
- Disable suspected accounts; force revoke refresh tokens (Entra ID) / invalidate console sessions (AWS).
- PIM close standing admin; password change staged domain-wide only when advised—coordinate with IR lead.
Network
- ACL emergency rules: block workstation-to-workstation RDP/SMB except known app servers; document rule IDs.
- Isolate jump boxes and RMM servers behind new firewall policy; assume actors live there.
Host
- EDR network isolate per device; if none, VLAN quarantine to internet-blocked sink.
Monitoring
Watch for new creations: users, scheduled tasks, GPOs, Golden Ticket symptoms (odd TGT patterns).
Validation
BloodHound or vendor graph after containment to confirm paths severed—retest 24h later.
Communication
Tell helpdesk stop re-imaging until scope clear—pattern reveals attacker TTPs.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...