Agent Foskett Academy • SOC Analyst Academy • Module 4 • Lesson 39 • Endpoint Incidents: Following the Attack Chain

Lesson 39 — The Device Needed Containment — What Happens Next?

By now the evidence was no longer a collection of weak clues.

The endpoint had shown suspicious PowerShell execution, file creation, outbound communication, persistence and possible credential access. The affected account had then appeared on another device.

The SOC had reached an operational decision:

the device needed containment.

But containment is not simply pressing an isolation button. The analyst must understand what evidence needs preserving, who needs coordinating, what business impact isolation may create and what must be checked afterwards.

Containment changes the environment. Record the evidence and the reason for the action before you change the state you are investigating.

Plan the Containment Back to SOC Analyst Academy

Agent Foskett planning endpoint containment in Microsoft Defender XDR

The investigation became a response

Preserve the timeline, assess business impact, coordinate isolation, investigate related identities and devices, and verify that containment achieved its purpose.

✓ Preserve evidence before action

✓ Assess containment impact

✓ Coordinate endpoint isolation

✓ Validate the post-containment state

Case briefing

WS-FIN-044 Browser → PowerShell ↓ Suspicious file executed ↓ External connection ↓ Persistence created ↓ Unexpected LSASS access ↓ Account appeared on WS-HR-021 ↓ SOC DECISION CONTAIN WS-FIN-044 BUT FIRST: What evidence must be preserved? Who needs to know? What other systems are involved? What happens after isolation?

Investigation objective

Move from evidence-led investigation into controlled containment without losing the timeline, overlooking related entities or assuming isolation alone has removed the threat.

Investigator's rule

Containment is a response action, not the end of the investigation. Isolation can stop communication while the SOC still needs to understand scope, persistence, credentials and remediation.

Stage 1 — record why containment is justified

Evidence	Why it matters
Suspicious process chain	Connects browser activity to PowerShell and the unknown executable.
Outbound connection	Shows the suspicious process communicating externally.
Persistence	Indicates an attempt to maintain execution.
LSASS-related activity	Raises possible credential-access risk.
Second-device logon	Expands concern beyond the original endpoint.

Write the reason before acting

A responder reviewing the incident later should be able to see exactly which evidence justified containment at that moment.

Urgency still needs discipline

Strong evidence may require rapid action, but urgency does not remove the need for timestamps, notes and coordination.

Stage 2 — preserve the immediate endpoint timeline

12345 67891011 1213

let TargetDevice = "WS-FIN-044";
let StartTime = datetime(2026-08-25 10:10:00);
let EndTime   = datetime(2026-08-25 10:25:00);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (StartTime .. EndTime)
| project Timestamp,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          SHA1
| order by Timestamp asc

Preserve the pivots

Record important hashes, process names, command lines, accounts, IP addresses, URLs, task names and timestamps before response actions alter the endpoint state.

Use the incident record

Investigation notes should explain what was observed, what was inferred, what remains unknown and which response action was authorised.

Stage 3 — assess the impact of isolation

BEFORE ISOLATION Is this a workstation? ↓ Is this a production server? ↓ Does it support a critical service? ↓ Could isolation interrupt operations? ↓ Is immediate containment still required? ↓ WHO MUST BE COORDINATED?

Asset criticality matters

Isolating an employee workstation and isolating a production server can have very different operational consequences.

Risk can override convenience

Business impact must be considered, but active compromise may still justify immediate containment under the organisation's incident-response procedures.

Stage 4 — isolate through the approved response process

Microsoft Defender for Endpoint can provide device-response capabilities such as device isolation when the required permissions and platform support are available. The analyst should use the organisation's authorised incident-response procedure rather than improvising a containment action.

Document who authorised the containment, when it occurred, which device was affected and the reason for the action.

Isolation is not deletion

Containing the endpoint is intended to restrict its ability to communicate. It does not automatically remove persistence, malicious files or compromised credentials.

Keep the case open

The device may be isolated while investigation continues into other endpoints, accounts, cloud sessions and infrastructure.

Stage 5 — check the second device immediately

12345 678910111213

let RelatedDevice = "WS-HR-021";
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName =~ RelatedDevice
| project Timestamp,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          SHA1
| order by Timestamp asc

Containment scope may grow

If the second endpoint shows related malicious activity, the response plan must expand. Isolating only the first device may be insufficient.

Do not chase devices blindly

Use evidence to determine which related endpoints require containment. A shared account or ordinary logon does not automatically make every device compromised.

Stage 6 — investigate the affected identity

12345 6789101112

let TargetAccount = "alex.wilson";
DeviceLogonEvents
| where Timestamp > ago(24h)
| where AccountName =~ TargetAccount
| project Timestamp,
          DeviceName,
          ActionType,
          LogonType,
          RemoteIP,
          RemoteDeviceName
| order by Timestamp asc

Endpoint containment does not contain identity

If credentials or sessions are compromised, isolating a workstation does not automatically prevent the account from being used elsewhere.

Coordinate identity remediation

Password reset, session revocation, authentication-method review and other identity actions should follow the organisation's response process and the evidence collected during the incident.

Stage 7 — verify what happened after containment

DEVICE ISOLATED ↓ RECORD TIME OF ACTION ↓ VERIFY DEVICE STATE ↓ CHECK FOR RELATED ALERTS ↓ HUNT OTHER DEVICES ↓ REVIEW ACCOUNT ACTIVITY ↓ REMOVE / REMEDIATE PERSISTENCE ↓ VALIDATE CLEAN STATE ↓ RECOVER UNDER CHANGE CONTROL

Containment needs validation

Confirm that the intended response action completed successfully and continue monitoring for evidence that the attacker remains active elsewhere.

Recovery is a separate decision

Do not reconnect a device simply because the immediate alert has stopped. Recovery should follow remediation and validation.

Stage 8 — separate containment, remediation and recovery

Phase	Purpose
Containment	Limit the attacker's ability to continue or spread.
Investigation	Determine scope, evidence, affected entities and attack sequence.
Remediation	Remove malicious artifacts, persistence and compromised access.
Recovery	Return systems safely to normal operation after validation.

Stage 9 — make the SOC response record defensible

CONTAINMENT RECORD Device: WS-FIN-044 Decision: Isolate endpoint Evidence: - suspicious PowerShell chain - malicious-looking executable - outbound network connection - persistence creation - unexpected LSASS access - possible movement to WS-HR-021 Action: Endpoint containment initiated under approved incident-response procedure Follow-up: - investigate WS-HR-021 - scope alex.wilson activity - remediate persistence - validate endpoint state - coordinate identity response - determine recovery conditions

Lesson 39 key takeaways

Containment should be justified by documented evidence.
Preserve important pivots and timestamps before changing endpoint state.
Consider asset criticality and operational impact.
Use authorised incident-response procedures for device isolation.
Isolation does not automatically remove malicious artifacts or persistence.
Endpoint containment does not automatically contain a compromised identity.
Investigate related devices before assuming the incident is contained.
Separate containment, remediation and recovery decisions.
Verify the response action and continue hunting afterwards.
Document who acted, what changed, when it changed and why.

Module 4 — Endpoint Incidents: Following the Attack Chain

Lesson 39 moves the SOC from investigation into response. In the final lesson of Module 4, Agent Foskett reconstructs the complete endpoint compromise from the original execution chain through persistence, credential access, movement and containment.

Next: Lesson 40 — Building the Complete Endpoint Compromise Timeline

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 4: Endpoint Incidents: Following the Attack Chain

Follow endpoint evidence across execution, persistence, credential access, movement and containment.

← Previous lesson

Lesson 38 — The Account Logged On to Another Device Minutes Later Follow possible lateral movement.

✅ Current lesson

Lesson 39 — The Device Needed Containment — What Happens Next? Move from investigation to isolation, evidence collection and remediation.

Next lesson →

Lesson 40 — Building the Complete Endpoint Compromise Timeline Reconstruct the attack chain from execution to movement.

How to contain a compromised endpoint in Microsoft Defender XDR

Lesson 39 of the Agent Foskett SOC Analyst Academy teaches analysts how to move from investigation to containment, preserve endpoint evidence, assess business impact, coordinate device isolation and continue hunting related identities and devices.

SOC endpoint containment and remediation workflow

Learn the difference between containment, investigation, remediation and recovery, and how Microsoft Defender XDR telemetry supports an evidence-led response to an endpoint compromise.