The alert is confirmed and one host is dirty. What you do in the next hour decides whether the investigation has evidence to work with, or a reimaged machine and a guess.
The first decision: isolate, do not power off
Network-isolate the host through your EDR, or move the switch port to a quarantine VLAN. Isolation cuts command-and-control and lateral movement while leaving RAM, running processes and your agent link intact.
Powering off costs you everything volatile: memory-resident payloads, keys held in a process, established connections, and temp files that a shutdown may clean up. It can also trigger the thing you are trying to avoid, since some malware acts on boot and a graceful shutdown lets logoff scripts run.
Two exceptions worth naming. Active destruction in front of you (files being encrypted or wiped) can justify pulling network and power on a low-value host. And a virtual machine is better suspended or snapshotted than shut down, because the snapshot includes memory.
Collect in order of volatility
RFC 3227 gave the ordering in 2002 and it still holds: registers and cache, then memory, then network state and running processes, then disk, then remote logs, then archival media. Collect what disappears first, first.
- Memory. Image RAM before you do much else on the box (WinPmem or DumpIt on Windows, AVML on Linux). Write it to attached external storage or a share, never to the suspect disk.
- Volatile state. Connections, the process tree with command lines, logged-on sessions, services, scheduled tasks, DNS cache, ARP table.
- Triage artifacts. Event logs,
$MFT, the USN journal, prefetch, registry hives, browser history. A targeted collection takes minutes where a full image takes hours. - Full disk image when the case is likely to end in litigation, HR action or a law-enforcement referral.
A minimal volatile-state pass:
Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, Name, CommandLine
Get-NetTCPConnection -State Established |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
Get-ScheduledTask | Where-Object State -ne 'Disabled'
Get-FileHash -Algorithm SHA256 .\host01-mem.raw
Everything you type changes the host
There is no read-only interaction with a live system. Running a tool loads DLLs, updates prefetch, writes registry keys and touches access times. That is acceptable. Unrecorded changes are not.
- Run tools from external media where you can, and prefer the EDR live-response channel over an interactive logon.
- Keep a contemporaneous action log: UTC timestamp, host, the exact command, who ran it, why. Your own footprints will appear in the timeline later and you need to be able to subtract them.
- Hash every artifact at collection and again when it reaches the evidence store. Keep originals read-only and analyze copies. That habit, plus a record of who held what and when, is chain of custody.
Do not log in with a privileged account
Interactive and RDP logons place credential material on the host. Authenticating to a machine you believe an attacker controls, using an account that can reach the whole domain, is how a one-host incident becomes a domain incident. Use a dedicated low-privilege response account or the agent channel, and treat any credential that has touched the host as burned.
Move incident comms out of band for the same reason. If the mail or chat tenant may be compromised, coordinating the response inside it tells the attacker exactly what you know.
Resist the urge to clean
Deleting the payload, running a full AV scan or resetting the one obviously bad account feels like progress. It destroys evidence, and it tips the attacker off while their other footholds are still unknown. Eradicate once, everywhere, after scoping.
What hour one is for
Not attribution and not eradication. Hour one answers three questions: what changed on this host, when did it start, and what else is affected? Everything you collect should serve one of those three, and nothing you do should make them harder to answer later.