A SOC analyst receives a high-priority alert: 'Lateral Movement Detected — SMB connection from workstation to domain controller using local admin credentials.' What is the most critical first investigative step?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — validate the alert first. Check whether the SMB connection is authorized IT activity, like a scheduled task, patch management, or a backup agent, before escalating it as an incident.
Full Explanation
The correct first step is validation: check whether this SMB connection from a workstation to a domain controller using local admin credentials is authorized IT activity, such as a scheduled task, patch management, or a backup agent, before escalating it as an incident. The first step in any alert triage is validation — determining whether the activity is authorized (IT admins performing maintenance, backup agents, patch management systems) or malicious; escalating or taking disruptive action without validation wastes resources on false positives. Reimaging the workstation and the domain controller immediately is wrong because reimaging without investigation destroys evidence and may cause unnecessary downtime if the activity was legitimate. Blocking all SMB traffic enterprise-wide at the firewall is wrong because it would disrupt file sharing, printing, and many critical services based on one alert. Resetting the domain admin password without further investigation is wrong because it could disrupt IT operations and is premature.