Emergency Containment Triage, Volatile Memory Capture, and Crisis Communication

Operational Directive from the Incident Commander. Last revised during active operational deployment: 14 August 2026.

OPERATIONAL DEPLOYMENT STATUS: ACTIVE. For worldwide tactical cyber response, contact the Rapid Deployment Center at 888-351-4380.

1. Tactical Perspective: Engaging the Unseen Adversary

When confronted with a sophisticated, unattributed anomaly within your infrastructure, the standard operating procedure of running an antivirus sweep or initiating a casual reboot is not just ineffective—it is actively destructive. As an Incident Commander or First Responder, your mindset must immediately shift from routine administration to adversarial warfare. You are operating in an environment that is presumed hostile, where the telemetry provided by your Endpoint Detection and Response (EDR) solutions, Security Information and Event Management (SIEM) systems, and native operating system logs may have been subverted, blinded, or entirely fabricated by an entrenched actor.

Advanced threat actors—ranging from state-sponsored Advanced Persistent Threats (APTs) to sophisticated ransomware-as-a-service (RaaS) affiliates—employ methodologies such as Bring Your Own Vulnerable Driver (BYOVD) to explicitly neutralize kernel-level visibility. By exploiting cryptographically signed but vulnerable drivers (e.g., Capcom.sys, gdrv.sys), adversaries achieve ring-0 execution privileges, allowing them to unhook EDR callbacks, blind Event Tracing for Windows (ETW), and subvert the underlying operating system architecture. They utilize reflective DLL injection, process hollowing, and process doppelgänging to execute payloads entirely within unbacked memory regions. This ensures that no malicious binary ever touches the physical disk, rendering traditional signature-based Anti-Virus (AV) completely obsolete.

In these high-stakes scenarios, the volatile memory (RAM) is your only battlefield. The decisions made in the first sixty minutes following detection—the 'Golden Hour' of Incident Response—will definitively dictate the trajectory of the entire engagement, the extent of data exfiltration, and the ultimate financial and reputational cost to the organization. This document serves as the authoritative, granular blueprint for executing emergency containment triage, preserving volatile artifacts, and managing crisis communications during an active, unattributed cyber intrusion.

2. Phase I: Emergency Containment Triage

The immediate objective during an active intrusion is not remediation, eradication, or even identification. The paramount directive is containment. You must halt lateral movement, terminate Command and Control (C2) beaconing, and arrest data exfiltration without alerting the adversary to your presence or triggering automated destructive logic bombs (such as master boot record wipers or rapid ransomware encryption routines).

2.1. Network Severance at the Transport Layer

Standard software-based isolation (e.g., clicking 'network contain' within a centralized EDR dashboard) relies on an operating system and an agent that you can no longer trust. If the adversary has ring-0 access, they can intercept the EDR's isolation command and drop it, while falsely reporting success to the central management console. Containment must occur out-of-band, ideally at the physical or hypervisor layer.

  1. Hardware-Level Port Shutdown: For physical appliances, access the managed switch via an out-of-band (OOB) management interface (e.g., a dedicated management VLAN or direct serial console connection). Administratively down the specific port connected to the compromised asset. In Cisco IOS, this requires navigating to the interface configuration mode (interface GigabitEthernet0/1) and issuing the shutdown command. Verify the link status changes to 'administratively down'.
  2. Hypervisor Disconnection Protocol: For virtualized environments, do not rely on guest-level firewall rules or interface controls. Access the underlying hypervisor management plane (e.g., VMware vCenter, Microsoft Hyper-V Manager, Proxmox VE, or Nutanix Prism). Disconnect the virtual network interface card (vNIC) at the hypervisor level. In VMware PowerCLI, execute the following syntax: Get-VM -Name "Compromised_Host" | Get-NetworkAdapter | Set-NetworkAdapter -Connected $false -Confirm:$false. This severs the network connection at the virtual switch (vSwitch) level, a mechanism the guest operating system—and by extension, the adversary—cannot bypass or manipulate.
  3. BGP Blackholing and DNS Sinkholing: If the compromised asset is observed communicating with a known malicious infrastructure (e.g., a specific IP address or domain associated with Cobalt Strike team servers or a known ransomware affiliate), immediately implement BGP route blackholing at your core perimeter routers. Advertise a null route for the malicious IP space to drop traffic at the network edge. Simultaneously, redirect malicious domain queries within your internal DNS infrastructure to a controlled internal sinkhole. This allows you to capture beaconing telemetry (source IP, frequency, user-agent) without permitting the traffic to reach the adversary.
  4. Zero-Trust Micro-Segmentation Enforcements: In modern environments utilizing Software-Defined Networking (SDN) or micro-segmentation platforms (e.g., VMware NSX, Cisco ACI, Illumio), push an emergency quarantine policy. This policy must enforce a default-deny posture, permitting only specific, heavily monitored management ports (e.g., SSH/22, RDP/3389 restricted to a dedicated incident response jump box) and dropping all other ingress and egress traffic, including ICMP and internal subnet communication.
  5. Handling Cloud Workloads: For assets residing in Public Cloud infrastructure (AWS, Azure, GCP), leverage cloud-native security controls. In AWS, detach the existing Security Group from the compromised EC2 instance and attach an 'Isolation' Security Group that contains zero egress rules and only permits ingress from your designated forensic IP space. In Azure, apply a strict Network Security Group (NSG) to the Virtual Machine's network interface.

2.2. Paralysis of Automated Orchestration

Sophisticated adversaries anticipate standard Security Orchestration, Automation, and Response (SOAR) playbooks. They monitor process creation events and system logs to detect the initiation of forensic sweeps or automated remediation attempts. An automated script that attempts to query Windows Management Instrumentation (WMI), execute a remote PowerForensics sweep, or force a system reboot may be the precise trigger condition for a pre-programmed logic bomb, resulting in immediate, catastrophic encryption of the file system.

  1. Suspend SOAR Playbooks: Immediately halt all automated containment and enrichment scripts targeting the affected subnet within your SOAR platform (e.g., Cortex XSOAR, Splunk Phantom, Swimlane).
  2. Halt Scheduled Tasks and Configuration Management: Disable enterprise-wide patch management software, vulnerability scanners (Tenable, Qualys), and configuration management tools (Microsoft SCCM, Ansible, Puppet, Chef). These tools routinely connect to endpoints, authenticate with high privileges, and alter the system state. Any interaction with the compromised host can overwrite critical volatile artifacts or provide the adversary with fresh, highly privileged credentials (e.g., through pass-the-hash attacks against the service account used by the scanner).
  3. Disable Active Directory Accounts: If specific user or service accounts are identified as compromised or exhibiting anomalous behavior (e.g., anomalous Kerberos Ticket Granting Ticket requests, impossible travel logins), immediately disable those accounts within Active Directory. Do not merely reset the password; an active, persistent threat actor may already possess Golden Ticket capabilities, rendering password resets ineffective.

2.3. The Cardinal Rule: Preserve Volatile State

Under no circumstances should the compromised system be powered off, hard-rebooted, or placed into hibernation.

Volatile memory (RAM) is the epicenter of the investigation. It contains the decrypted payload of the malware, active network sockets established with the C2 server, injected threads running within legitimate processes, recently executed commands, and critically, the cryptographic keys used by ransomware or data exfiltration utilities. A power cycle irrevocably destroys this volatile evidence. Once the power is cut, you are effectively blinding the forensic investigation, destroying the only artifacts that can definitively prove the adversary's capabilities, intent, and persistence mechanisms.

If an executive or untrained IT staff member insists on "pulling the plug" to stop an attack, the Incident Commander must exercise absolute authority to countermand that order. The physical isolation of the network cable achieves the goal of stopping the attack's spread while preserving the crime scene for forensic analysis.

3. Phase II: Volatile Memory Capture Protocol

With the asset successfully isolated at the network layer, the focus shifts entirely to evidence preservation. Memory acquisition is a highly sensitive, technically demanding operation that must be executed with surgical precision. The primary challenge is minimizing the 'smearing' effect—the corruption of data caused by the operating system continuing to allocate, deallocate, and write to RAM during the time it takes to capture the memory dump.

3.1. Acquisition Methodology and Tooling

The selection of the acquisition tool depends heavily on the target operating system, architecture, and the suspected presence of anti-forensic kernel-level rootkits.

  1. Kernel-Level Acquisition (Windows): Utilize forensic tools that load a cryptographically signed driver to access physical memory directly via the \Device\PhysicalMemory object or by manipulating page table entries. WinPMEM (part of the Rekall memory forensic framework) and DumpIt (historically by Comae Technologies, now Magnet Forensics) are industry standards for Windows environments. These tools must be executed with administrative privileges.
  2. Kernel-Level Acquisition (Linux): Linux memory acquisition requires the compilation and insertion of a Loadable Kernel Module (LKM). The LiME (Linux Memory Extractor) framework is the standard tool. Crucially, LiME must be compiled against the specific kernel headers of the target system. Compiling LiME on the compromised system itself alters the environment and overwrites artifacts. Therefore, you must identify the target's kernel version (uname -r), compile the LiME module on a pristine, identical forensic workstation, and then transfer the compiled .ko file to the compromised host for execution.
  3. Hypervisor-Level Snapshots (The Gold Standard): If the compromised system is a virtual machine, leverage the hypervisor to capture the memory state. This is the optimal methodology. In VMware vSphere, taking a snapshot with the 'Snapshot the virtual machine's memory' option selected generates a .vmem file containing the complete, unsmeared physical memory space. This method is vastly superior to in-guest acquisition because it leaves zero forensic footprint on the target, involves no interaction with the compromised operating system, and completely bypasses any rootkits designed to hide memory regions or hook API calls.
  4. Execution Environment: Never execute the in-guest acquisition tool directly from the compromised system's local hard drive. Downloading the tool via a web browser or copying it to the C:\ drive overwrites hundreds of megabytes of unallocated space, potentially destroying deleted files, prefetch data, or Master File Table (MFT) records. Always mount a write-blocked, sterilized USB drive containing statically compiled forensic binaries, or attach a read-only ISO image to the virtual machine.
  5. Destination Media: Write the resulting memory dump (.raw, .mem, .img, or .aff4) directly to an external, sterilized, and encrypted storage volume. Ensure the destination media has sufficient capacity. A system with 128GB of RAM will generate a file of at least 128GB. Attempting to write a memory dump to a drive with insufficient space will crash the acquisition tool and potentially destabilize the target system.

3.2. Capturing Paged Data

Modern operating systems utilize virtual memory management, paging idle memory blocks to the physical disk to free up physical RAM. Crucial forensic artifacts, including portions of the adversary's injected code or decrypted strings, may be swapped out to disk at the time of acquisition.

  1. Windows Paging Files: You must acquire the system's paging files to ensure a complete forensic picture. This includes pagefile.sys (the primary virtual memory store) and swapfile.sys (utilized specifically by Universal Windows Platform applications). These files are locked by the operating system and cannot be simply copied. You must use raw disk access tools (e.g., FTK Imager CLI, RawCopy) to extract them.
  2. Hibernation Data: If the system is a laptop or has entered hibernation at any point, hiberfil.sys contains a highly compressed snapshot of the entire physical memory space at the time of hibernation. This file can be extracted and subsequently decompressed and analyzed using Volatility's imagecopy plugin, often revealing historical malware execution that is no longer present in active RAM.

3.3. Cryptographic Chain of Custody

The moment the memory acquisition completes, the integrity of the evidence must be cryptographically sealed. This is a non-negotiable legal requirement.

  1. Immediate Hashing: Calculate the cryptographic hash (SHA-256, SHA-512, or BLAKE2) of the memory dump file immediately upon completion. Do not use MD5 or SHA-1, as they are cryptographically broken and vulnerable to collision attacks.
  2. Documentation: Document the resulting hash, the exact time of acquisition (noting the timezone, preferably UTC), the specific tool and version used (e.g., WinPMEM v3.3.rc3), the physical location of the asset, and the name of the personnel conducting the acquisition in a formal Chain of Custody ledger.
  3. Legal Defensibility: This rigorous documentation is not merely bureaucratic overhead; it is the absolute foundation upon which the legal defensibility of your investigation rests. If the incident escalates to civil litigation, regulatory enforcement, or criminal prosecution, defense attorneys will ruthlessly attack the chain of custody. Any gap in documentation or failure to cryptographically verify the evidence will render the forensic findings inadmissible in a court of law.

4. Phase III: Crisis Communication and Out-of-Band Operations

An advanced adversary who has achieved deep persistence within your network has almost certainly compromised your primary communication channels. Discussing containment strategies, sharing indicators of compromise (IOCs), or coordinating the Incident Response plan over Microsoft Exchange email, corporate Slack channels, or Microsoft Teams when the underlying Active Directory environment is compromised is akin to broadcasting your battle plan directly to the enemy. The adversary will monitor your communications, anticipate your containment actions, and adapt their tactics to maintain persistence or accelerate their destructive objectives.

4.1. Establishing the Out-of-Band (OOB) Matrix

You must assume that all internal corporate communications are compromised. Immediate establishment of a secure, isolated communication matrix is mandatory.

  1. Secure Enclaves: Immediately stand up an isolated, cloud-hosted communication platform. This could be a distinct Signal group utilizing end-to-end encryption, a separate Wickr enterprise workspace, or a newly provisioned, isolated Microsoft 365 tenant dedicated solely to the Incident Response team. This OOB environment must share zero infrastructure, Identity Providers (IdP), Active Directory federations, or credentials with the primary corporate network.
  2. Device Sterilization: Access to the OOB matrix must occur strictly from sterilized, physically separate devices. Do not use corporate-issued laptops or cell phones connected to the corporate MDM (Mobile Device Management) platform. Utilize newly purchased Chromebooks, iPads, or 'burner' laptops routed through dedicated cellular hotspots, completely bypassing the corporate LAN and VPN infrastructure.
  3. Code Word Implementation: Assign a randomized, non-descriptive code word to the incident (e.g., "Operation Cobalt Dawn"). All OOB communications, meeting invites, and documentation must reference the incident exclusively by this code word. This prevents inadvertent disclosure or alerting the adversary if an OOB message is accidentally intercepted or shoulder-surfed.

4.2. Stakeholder Synchronization and Operational Security (OPSEC)

The Incident Commander must orchestrate the flow of information with extreme prejudice to prevent panic, ensure unified tactical action, and comply with strict legal obligations.

  1. The War Room (Physical and Virtual): Establish a dedicated War Room. Access must be strictly regulated based on the principle of least privilege. Only essential personnel—the Core Incident Response Team, designated external DFIR consultants, specialized Legal Counsel, and a single Executive Sponsor—are permitted access. All other staff, including senior IT management not directly involved in the tactical response, must be excluded to maintain OPSEC.
  2. Attorney-Client Privilege: Route all initial findings, technical artifacts, forensic reports, and strategic discussions through external, specialized cybersecurity legal counsel. This establishes Attorney-Client Privilege and Attorney Work Product protection. This critical step protects the investigation's raw data, preliminary (and potentially erroneous) findings, and internal deliberations from premature discovery by opposing counsel during subsequent civil litigation or regulatory inquiries.
  3. Third-Party Notifications: Coordinate exclusively with legal counsel to determine the appropriate timeline and threshold for notifying external entities. This includes cyber insurance carriers (who often require notification within 24-48 hours to activate coverage), external DFIR retainers, and law enforcement agencies (e.g., the FBI's Cyber Division, CISA, or Europol). Premature or unauthorized notification can trigger aggressive regulatory oversight and media leaks; delayed notification can violate strict compliance mandates and void insurance policies.

5. Phase IV: Unattributed Anomaly Hunting in Volatile Artifacts

With the memory dump secured and cryptographically verified, the tactical focus shifts to deep forensic behavioral analysis. Traditional signature-based detection is irrelevant in this phase; the adversary is utilizing bespoke, dynamically compiled payloads, heavy obfuscation, and kernel-level manipulation. The goal is to uncover the 'ground truth' of the system state, bypassing the lies told by the compromised operating system APIs.

5.1. Direct Kernel Object Manipulation (DKOM) Identification

Sophisticated rootkits often sever the linked lists that the Windows kernel uses to track active processes (specifically, the ActiveProcessLinks within the EPROCESS structure). By unlinking a process, the adversary effectively hides their malicious execution from standard diagnostic tools like Task Manager, Process Explorer, and poorly configured EDR agents, while the process continues to execute and maintain network connections.

  1. Cross-View Triage Methodology: Utilize advanced memory forensic frameworks (such as Volatility 3 or Rekall) to perform rigorous cross-view analysis. First, execute the windows.pslist plugin. This plugin traverses the standard ActiveProcessLinks doubly-linked list, retrieving the active process list exactly as it is reported by the compromised OS APIs.
  2. Deep Structure Carving: Subsequently, execute the windows.psscan plugin. Instead of trusting the linked list, psscan performs a raw, byte-by-byte carve of the entire physical memory space, searching for the specific magic headers and pool tags associated with the EPROCESS structure.
  3. Discrepancy Analysis: Compare the output of pslist against psscan. Any process identified by the deep carve (psscan) but absent from the linked list (pslist) is definitively utilizing DKOM to actively evade detection. This is an immediate, high-confidence indicator of a ring-0 rootkit compromise.

5.2. Identifying Unbacked Execution and Process Hollowing

Modern, fileless malware frequently unpacks and executes entirely within RAM, bypassing disk-based AV scanning.

  1. Memory Protection Analysis (VAD Walking): Execute the windows.malfind plugin. This powerful module walks the Virtual Address Descriptor (VAD) tree for every active process, analyzing memory protection flags. It specifically scans for memory regions allocated with PAGE_EXECUTE_READWRITE (RWX) permissions that are not mapped to a corresponding physical file on disk. While legitimate Just-In-Time (JIT) compilers (like the .NET CLR or Java Virtual Machine) legitimately exhibit this behavior, unbacked RWX regions found injected within core Windows processes like explorer.exe, svchost.exe, notepad.exe, or lsass.exe are definitive indicators of reflective DLL injection, shellcode execution, or process hollowing.
  2. Process Lineage and Argument Anomalies: Analyze the process execution hierarchy using the windows.pstree plugin. Adversaries often attempt to blend in by naming their malicious processes after legitimate Windows binaries. However, they frequently fail to replicate the correct parent-child lineage or command-line arguments. For example, a legitimate svchost.exe must always be spawned by services.exe and must include the -k parameter followed by the service group name. An svchost.exe spawned by cmd.exe, powershell.exe, or wmiapsrv.exe, or lacking the -k flag, is a malicious imposter executing an unknown payload. Similarly, lsass.exe (Local Security Authority Subsystem Service) should only ever have one instance, spawned directly by wininit.exe. Multiple instances of lsass.exe indicate a credential dumping operation or a deeply entrenched credential stealer.

5.3. Payload Extraction and Deep Technical Analysis

  1. Memory Segment Dumping: Once the malicious process, injected thread, or unbacked memory region is identified via malfind or lineage analysis, extract the raw binary data utilizing the windows.procdump (to dump the entire executable) or windows.vaddump (to dump specific, targeted memory pages) plugins.
  2. Static Indicator Extraction: Perform intensive static analysis on the dumped memory segments. Utilize the strings command, carefully filtering for both Unicode (16-bit) and ASCII (8-bit) text formats. The objective is to extract embedded, hardcoded indicators: IPv4/IPv6 addresses, C2 domain names, unique Mutex names used for persistence, specific HTTP User-Agent strings, and Program Database (PDB) debug paths (which often reveal the developer's original project directory structure, e.g., C:\Users\Ivan\Desktop\RansomProject\build\Release\payload.pdb). These artifacts form the foundational intelligence required to hunt the adversary across the rest of the enterprise.
  3. Custom YARA Engineering and Enterprise Sweeps: Craft highly specific, bespoke YARA rules targeting the unique byte sequences, hexadecimal patterns, and string combinations identified within the dumped payload. Do not rely on generic, open-source YARA rules; they will likely miss custom-compiled variants. Deploy these bespoke YARA rules across your EDR platform or enterprise forensic sweeping tools (e.g., Velociraptor, GRR Rapid Response) to hunt for secondary infections, dormant persistence mechanisms, or active lateral movement across the entire infrastructure.

6. Phase V: Eradication, Rebuild, and Regulatory Posture

You have identified the anomaly, contained the host, extracted the operational intelligence, and swept the enterprise. You must now eliminate the threat with extreme prejudice and navigate the ensuing legal fallout.

6.1. The Scorched Earth Rebuild Methodology

Do not attempt to 'clean' or 'disinfect' the compromised system using antivirus removal tools. Advanced threats manipulate the Unified Extensible Firmware Interface (UEFI), overwrite the Master Boot Record (MBR), or embed themselves so deeply within the Windows Registry and WMI repositories that guaranteed eradication is impossible without destruction.

  1. Storage Annihilation: Cryptographically wipe the physical storage media using DoD 5220.22-M standard wiping protocols. If cryptographic wiping is unavailable or the drive is a solid-state drive (SSD) where wear-leveling algorithms prevent guaranteed overwrites, physically destroy the drives via commercial shredding or degaussing services. Obtain a certificate of destruction.
  2. Firmware Flash and Integrity Verification: Before re-imaging the hardware, you must assume the motherboard firmware is compromised. Re-flash the motherboard BIOS/UEFI from a known-good, manufacturer-verified image downloaded from an uncompromised machine. This mitigates the critical risk of a persistent, low-level bootkit (e.g., Lojax, MosaicRegressor, BlackLotus) surviving the operating system reinstallation and reinfecting the new environment upon first boot.
  3. Baseline Restoration: Rebuild the operating system from a pristine, read-only deployment image. Implement immediate post-deployment hardening: disable LLMNR/NBT-NS, enforce SMB signing, deploy LAPS (Local Administrator Password Solution), and restrict PowerShell execution policies before the machine is allowed to reconnect to the production network.

6.2. Navigating the Regulatory Minefield: The "Presumed Compromise" Stance

In the aftermath of an unattributed infection, particularly those involving advanced data exfiltration capabilities (e.g., sophisticated infostealers, silent ransomware staging operations, or APT espionage), regulators operate strictly under a 'Presumed Compromise' doctrine.

If your forensic investigation cannot definitively, mathematically prove that sensitive data—Personally Identifiable Information (PII), Protected Health Information (PHI), or Payment Card Industry (PCI) data—was not exfiltrated, regulatory bodies will assume a worst-case scenario data breach. This triggers severe notification requirements under frameworks such as the General Data Protection Regulation (GDPR) Article 33 (requiring notification within 72 hours of becoming aware of the breach), the Health Insurance Portability and Accountability Act (HIPAA), and the SEC's cybersecurity disclosure rules (requiring public companies to disclose material breaches within four business days via an 8-K filing).

The meticulous documentation of your containment triage, the cryptographically verified integrity of your memory captures, and the rigorous, scientifically sound methodology of your forensic analysis are your primary, and often only, defense against catastrophic regulatory fines, class-action lawsuits, and devastating reputational destruction. Your role as an Incident Commander extends far beyond neutralizing the immediate technical threat; you are the primary architect of the organization's legal, regulatory, and financial survival.

Return to the main Defensive Cybersecurity Hub for more malware family protection guides.

7. Why Certain Technical Deep-Dives Are Withheld: An AI Transparency Statement

When confronting an entirely uncharacterized cyber intrusion, the instinct of any skilled practitioner is to demand granular, actionable intelligence: the exact obfuscated PowerShell cradle, the specific registry persistence mechanism, or the precise lateral movement technique deployed by the adversary. Responsible AI governance, however, draws a firm line between educational context and weaponizable instructions.

The distinction matters because an unattributed compromise is, by definition, a zero-day scenario. Synthesizing functional exploit chains or evasion syntaxes for such scenarios would effectively create new offensive capabilities rather than documenting existing ones. The ethical obligation is clear: empower the incident commander with strategic comprehension of adversary tradecraft, not with a toolkit for replication.

What was restricted and why:

This deliberate restraint is not a gap in coverage — it is a principled design choice. By concentrating on the organizational response choreography — the communication cadence between SOC analysts, legal counsel, and executive stakeholders; the evidence preservation chain for potential litigation; the regulatory notification timelines under GDPR, HIPAA, or SEC disclosure rules — this guide delivers genuinely unique value that no exploit database or signature repository can replicate. The goal is to transform an unknown, paralyzing threat into a structured, manageable incident through superior process discipline rather than superior offensive capability.

Related Defensive Playbooks

Continue strengthening your security posture by reviewing our other threat-specific response guides: