Containment, Eradication, Recovery

The instinct when you find a compromised box is to yank the power cord. Do that and you just deleted everything in RAM: the attacker's running process, their open network connections, the decryption keys, the injected code that never touched disk. Containment is a balance. You have to cut the attacker off while keeping the evidence alive.

Isolate the network, not the power

Pulling a host off the network stops lateral movement and exfiltration while leaving memory intact. That is almost always the right first move. You can do it at the host or, better, at the switch or firewall so the attacker does not see the interface drop from inside.

The surgical version, dropping just the C2 IP, keeps the host usable for investigation while denying the attacker their channel. Full interface-down is the blunt option when you cannot trust anything the box is doing. Either way, the machine stays powered so you can grab what is in RAM.

Order of volatility: grab the fragile stuff first

Evidence disappears at different speeds. Collect from most volatile to least, or you lose the good parts. Memory and live network state evaporate the instant the box reboots. Disk survives.

• CPU registers and cache: gone in nanoseconds, you will not catch these.
• RAM, running processes, network connections: gone on reboot. Grab first.
• Disk, logs, file timestamps: survive a reboot, collect after.
• Backups and archives: least volatile, collect last.

Capture memory before you do anything that might reboot the host. On Linux, AVML produces a clean image without needing a matching kernel module.

$sudo ./avml /mnt/evidence/INC-2026-0042/mem.lime

Hash every artifact the moment you collect it so you can prove it was not altered later. A sha256sum mem.lime > mem.lime.sha256 next to the image is the whole chain-of-custody habit in one line.

Eradicate, then recover, in that order

Eradication removes the foothold: kill the malicious process, delete the web shell, disable the rogue account, remove the cron job or scheduled task giving them persistence. The trap is doing this before you understand the full scope. If they have three persistence mechanisms and you find two, recovery just hands the box back to them.

Recovery restores clean systems from known-good backups, ones taken before the compromise window, and watches them hard. Validate the host is actually clean, rotate every credential that touched it, and monitor for the attacker trying the same door again. Attackers routinely come back within days to check whether you missed something.