5.2 Steps to Contain and Report
-
The “Golden Hour”: The first 60 minutes determine the damage.
-
Disconnect: Unplug the ethernet cable. Turn off Wi-Fi. (Do NOT shut down—this destroys RAM evidence).
-
Document: Note the time, what you were doing, and take photos of the screen (don’t take screenshots on the infected machine).
-
Report: Call the SOC (Security Operations Center) or IT Emergency Line immediately.
-