A technician responds to a report that a workstation is running abnormally slow. Investigation reveals a process named 'svc_host32.exe' consuming 90% CPU, making outbound connections to multiple IP addresses. What should the technician do FIRST?

Question

Accepted Answer

C. Quarantine the machine from the network. When active malware is suspected and is making outbound network connections, the immediate priority is to isolate the system from the network to prevent data exfiltration, lateral movement, or further C2 communication. Network quarantine must precede scanning, remediation, or restore operations to contain the threat. The process name 'svc_host32.exe' is a typosquatted impersonation of the legitimate 'svchost.exe', a classic malware indicator.

A technician responds to a report that a workstation is running abnormally slow. Investigation reveals a process named 'svc_host32.exe' consuming 90% CPU, making outbound connections to multiple IP addresses. What should the technician do FIRST?

Related Questions

Discussion