Incident Response Host Isolation, Live Memory Acquisition & Triage Forensics

1. Scope, Purpose & Order of Volatility

This standard operating procedure defines the tactical steps required when an endpoint (server or workstation) is suspected of active compromise, malware beaconing, credential dumping, or ransomware execution.

Order of Volatility (RFC 3227 Compliance)

When responding to an incident, evidence must be captured from most volatile to least volatile before powering off or rebooting the host:

1. CPU Registers, Cache, and Process Tables
2. System Memory (RAM) — Contains unencrypted encryption keys, injected shellcode, decrypted C2 payloads, network sockets.
3. Network State & Active Connections
4. Temporary File Systems & Running Process Artifacts
5. Non-Volatile Disk Storage ($MFT, Event Logs, Prefetch, Registry Hives)
6. Remote Backups and Archival Logs

DO NOT REBOOT OR POWER OFF THE MACHINE

Hard rebooting destroys volatile RAM evidence, unencrypted BitLocker keys in memory, and active memory-resident malware payloads.

---

2. Pre-Flight Incident Classification & Tools

Severity Level	Definition	Mandatory Immediate Action
P1 - Critical	Active ransomware spread, Domain Controller compromise, rootkit	Immediate network quarantine + Full RAM capture
P2 - High	Lateral movement detected, Mimikatz credential dump alert	Host isolation + RAM & artifact collection
P3 - Medium	Suspicious outbound beaconing, anomalous scheduled task	EDR isolation + Artifact triage analysis

Forensic Toolkit Preparation

Maintain an air-gapped, write-blocked USB drive or dedicated read-only forensic SMB share containing:

• winpmem.exe (v4.0+ signed kernel driver memory dumper)
• avml (Microsoft Automated Volatile Memory Acquisition for Linux)
• kape.exe (Kroll Artifact Parser and Extractor)
• sha256sum.exe / native PowerShell hash tools

---

3. Execution: Phase 1 — Host Network Isolation

Isolate the compromised system from the network immediately to sever Command & Control (C2) communication and halt lateral movement, while preserving remote management if possible.

Method A: EDR Host Isolation (Wazuh / Defender / CrowdStrike)

If EDR is active, invoke isolation from the centralized console:

• Windows Defender for Endpoint: Click Isolate Device (permits Defender cloud communication; severs all local and Internet IP traffic).
• Wazuh EDR Active Response:

# Force agent isolation via Wazuh Server
/var/ossec/bin/agent_control -b 10.10.20.150 -a 005

Method B: Network Switchport Quarantine (Cisco IOS-XE / Catalyst)

If EDR is disabled or unresponsive, immediately isolate via the core switch port:

core-switch# configure terminal
core-switch(config)# interface GigabitEthernet1/0/24
core-switch(config-if)# description QUARANTINED-INCIDENT-IR-202610
core-switch(config-if)# switchport access vlan 999
core-switch(config-if)# shutdown
core-switch(config-if)# end

---

4. Execution: Phase 2 — Volatile Memory Acquisition (RAM)

Always collect memory using write-minimizing techniques to an external destination (USB drive or direct forensic network target).

Windows Server Memory Capture (WinPmem):

Open an administrative PowerShell prompt:

# 1. Record current date and time
Get-Date -Format o | Out-File -FilePath D:\Evidence\acquisition_log.txt -Append

# 2. Capture live system RAM
.\winpmem.exe -o D:\Evidence\MEM_WIN_20261015.raw --mode 2

# 3. Compute cryptographic hash immediately for Chain of Custody
Get-FileHash -Algorithm SHA256 D:\Evidence\MEM_WIN_20261015.raw | Out-File -FilePath D:\Evidence\MEM_WIN_20261015.sha256

Linux Server Memory Capture (AVML):

Execute as root:

# 1. Download/mount AVML binary and execute capture
./avml --compress /mnt/forensic/MEM_LINUX_20261015.raw.lime

# 2. Hash raw memory image
sha256sum /mnt/forensic/MEM_LINUX_20261015.raw.lime > /mnt/forensic/MEM_LINUX_20261015.sha256

---

5. Execution: Phase 3 — Live Triage Artifact Collection

Windows Live Artifact Triage (PowerShell & KAPE):

Collect fast forensic triage packages ($MFT, Registry, Event Logs, Prefetch):

# 1. Capture Active Network Connections & Process PIDs
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess |
    Export-Csv -Path D:\Evidence\network_sockets.csv -NoTypeInformation

Get-Process | Select-Object Id,ProcessName,Path,StartTime,Company |
    Export-Csv -Path D:\Evidence\running_processes.csv -NoTypeInformation

# 2. Execute KAPE for Automated Triage Artifacts
.\kape.exe --tsource C: --tdest D:\Evidence\KAPE_Out --target KapeTriage --zip Evidence_Kape

Linux Live Artifact Triage (Bash):

# Capture active sockets and network state
ss -tupna > /mnt/forensic/ss_sockets.txt
ps auxwwwf > /mnt/forensic/ps_tree.txt
crontab -l > /mnt/forensic/crontab.txt

# Archive system logs and authentication logs
tar -czf /mnt/forensic/system_logs.tar.gz /var/log/syslog /var/log/auth.log /var/log/audit/audit.log

---

6. Chain of Custody & Evidence Preservation

Every piece of forensic evidence collected must have an associated Chain of Custody ledger entry:

EVIDENCE CUSTODY LEDGER:
- Case Reference ID: IR-2026-10-15-001
- Target Hostname: PROD-SRV-APP01 (IP: 10.10.20.150 / MAC: 00:50:56:AB:12:CD)
- Evidence Description: Complete Physical RAM Dump (MEM_WIN_20261015.raw)
- SHA-256 Checksum: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Acquired By: Security Operations Team
- Storage Medium: Encrypted BitLocker USB Serial: #USBFORENSIC-04
- Stored In: Cyber Security Safe #1 (Access Restricted to CISO & Lead Admin)

---

7. Remediation & Host De-isolation (Rollback)

Once the incident investigation confirms malicious processes are eliminated, persistent backdoors removed, and CISO sign-off received:

Step 1: Root-Cause Remediation Verification

1. Verify malware binary hash is blocked globally on perimeter firewall and EDR.
2. Confirm Active Directory credentials of compromised accounts were rotated twice (per SOP-SYS-040).
3. Scan filesystem with two independent offline AV engines.

Step 2: Restore Network Access

# Switchport restoration:
core-switch(config-if)# switchport access vlan 20
core-switch(config-if)# no shutdown

If using EDR:

• Navigate to EDR console and click Release from Isolation.

---

8. Incident Audit & Sign-off

Step	Completed Action	Validated By
Isolation Executed	Network boundary severed within 5 minutes of alert	Security Operations Team
RAM Acquired	Raw memory image captured and SHA-256 verified	Security Operations Team
Triage Captured	Prefetch, Event Logs, and Network sockets preserved	Security Operations Team
Chain of Custody	Vaulted and signed into physical evidence locker	Lead Systems Administrator / CISO