## Phase 3: Containment - Stop the Bleeding

The virus is inside. You have identified it. Now stop it from spreading.

### Short-Term Containment
Immediate action to stop damage.
*   **Network Isolation**: Unplug the ethernet cable. Disable the switch port. Use EDR "Network Isolate" feature.
*   **Shutdown**: Generally **BAD IDEA** because it destroys RAM (Memory evidence). Only shut down if the drive is actively being encrypted (Ransomware) and you can't stop it otherwise.
*   **Firewall Block**: Block the C2 IP addresses at the perimeter.

### Long-Term Containment
Fixing the temporary patches.
*   Apply patches to the vulnerability.
*   Change passwords for compromised accounts.
*   Strengthen firewall rules.

### Checkmate: The Attacker's Response
Be careful. Attackers monitor your response.
*   If you block their IP, they might get angry and deploy Ransomware immediately (The "Scorched Earth" policy).
*   Sometimes, you might want to **Watch and Wait** (Sandboxing the attacker) to learn their TTPs before cutting them off. This requires high skill and confidence.

### Evidence Preservation
During containment, you must preserve evidence.
*   **Chain of Custody**: A log of who held the hard drive, when, and where.
*   Make forensic images of the disk *before* you wipe anything.
*   Dump memory (RAM) before rebooting.