Critical severityNIST SP 800-6127 steps · 6 phases

Process Injection — Active C2 and Domain Compromise Response

When injection-based active C2 connectivity, lateral movement, or domain-level compromise is detected, executes comprehensive coordinated isolation, removal of injected components, systemic persistence scanning, and full system recovery.

Updated: June 13, 2026

Information note

Informational note: In an active C2 and domain compromise scenario, a rushed partial cleanup gives the attacker an opportunity to activate different persistence mechanisms. Until the full scope of the compromise is determined, domain administrator accounts should be restricted, known malicious IP/domain blocks applied, and affected systems rebuilt in a phased manner. Leaving even a single compromised system behind can nullify the entire cleanup effort.

Prepare

4 steps

Active C2 triage threshold
This playbook applies only when at least one of the following conditions is met: injection confirmed in a memory dump + network beacon trace present; lateral movement (SMB/RPC/WMI to a different host) proven; Domain Admin / SYSTEM token in the injection target; persistence mechanism (registry run key, scheduled task, WMI event subscription, service) detected
Coordinated response team
SOC L2/IR Lead, AD administrator, and CISO must be simultaneously engaged; all host isolation and network blocking decisions require approval from this trio
Do not begin eradication before evidence and visibility are complete
If cleanup begins before missed hosts or "blind spot" gaps are resolved, the attacker will return via a different access path; this is the most critical sequencing requirement in this playbook
Forensics capacity
Concurrent memory dump capacity equal to the number of affected hosts must be ready; verify EDR live response multi-host support

Detect & Analyze

5 steps

Process Injection — Active C2 and Domain Compromise Response

Prepare

Detect & Analyze

Contain

Eradicate

Recover

Post-Incident