Incident Response First Steps: What to Do With a Suspect Computer

A computer that is behaving strangely is a common starting point for an incident. A user reports pop-ups, a security tool raises an alert, or someone spots a remote-access program nobody installed. What happens in the next few minutes often decides how much you can learn later. This is a simple, practical procedure for handling a suspect computer, covering preparation as well as response.

Prepare before it happens

A little groundwork makes the first steps faster and safer.

• Make sure your endpoint security tool can isolate a device from the network with one action, and know who is allowed to use it.
• Keep disk encryption recovery keys somewhere you can reach them, because recovery keys can be needed to read or image an encrypted disk.
• Keep a clean spare device and a clean admin workstation, so you are not working from a machine the attacker may have touched.
• Check that logs from your firewall, endpoint tool and cloud services are retained long enough to be useful.

Step one: isolate, do not power off

Disconnect the computer from the network. Unplug the cable, turn off Wi-Fi, or use your endpoint tool to isolate it. Leave it powered on when you can, because memory can hold running processes, network connections and other evidence that disappears at shutdown. If something is actively destroying data and you cannot isolate it, pulling the power may be the better trade, so use judgment.

Step two: write down what you can see

Start this while the account work in step four begins in parallel, since containment does not wait on notes. Photograph the screen and note the time, the logged-in user, any messages, and what the user was doing when it started. Use UTC or note your time zone. Start a simple log of who did what and when. These notes are easy to skip and hard to recreate.

Step three: resist the urge to clean up

It is tempting to delete the odd file, uninstall the new program or reinstall the operating system. Hold off. Each of those can erase the evidence that explains how the attacker got in and what they touched. Do not copy files off with a personal USB drive, and do not sign in to the machine with a privileged administrator account, since credentials typed on a compromised system may be exposed.

Step four: protect the accounts

Assume the user’s credentials may be exposed. From a clean device, reset the password and revoke active sessions and tokens. Then look at the cloud side. In Microsoft 365, review recent sign-ins, mailbox rules, forwarding settings, new application consents and recently added authentication methods, and remove anything unexpected. Resetting the password alone does not remove a malicious rule or consent.

Step five: preserve the device

Label the computer, record who has handled it, and keep it isolated, powered and in a secure place until a responder confirms memory has been captured. Call the responder before any shutdown. If no one can attend promptly, a controlled shutdown on the responder’s instruction is better than waiting indefinitely. Hand it over with your notes. Pull relevant firewall, endpoint and cloud logs now, before they age out of retention.

Step six: ask for help

If the machine handled sensitive data, belongs to someone with elevated access, or shows signs of remote control, involve an incident response provider early, along with your insurer and counsel. Your counsel can advise on any legal or notification obligations.

Step seven: return it to service carefully

Once evidence is captured and the entry point is understood, rebuild the device from a trusted image rather than cleaning it in place. Watch the account and device closely for a while afterwards.

A short list of things to avoid

• Wiping or reimaging before evidence is captured.
• Running unfamiliar cleanup tools from the internet.
• Signing in with administrator credentials on the suspect machine.
• Leaving the device connected while you decide what to do.

For more on how we support response and readiness, see incident response and security services.

Message us to talk through your incident response plan.