Isolate Machine [FIX-9007]

Isolation is reversible. The device stays manageable from the Defender portal throughout, and connectivity is restored with the Release from isolation action once the device is safe to bring back online.

Rationale

When a device is compromised, isolating it from the network is the fastest way to stop an active attack from spreading. Network isolation severs the device's ability to communicate with other hosts and with attacker command-and-control infrastructure, which contains lateral movement, data exfiltration, and ransomware propagation, while preserving the device for forensic analysis rather than wiping or shutting it down.

Microsoft Defender supports two isolation levels. Full isolation blocks essentially all network traffic except the device's connection to the Defender service, and is the right choice for an actively compromised endpoint. Selective isolation restricts a narrower set of traffic, allowing some applications (such as Outlook and Teams) to keep working, and is used when full isolation would be too disruptive for the level of risk. The configured isolation type lets you match the containment strength to the incident.

This remediation POSTs to the Defender isolate machine action API with the configured isolation type and a comment identifying Attic as the initiator. It requires the Machine.Isolate permission on the Microsoft Defender (WindowsDefenderATP) application.

Fix

An automated fix is available through Attic.

Manual steps:

1. Navigate to the Microsoft Defender portal at https://security.microsoft.com
2. Go to Assets > Devices
3. Search for and select the affected device
4. Open the device page and click Isolate device in the action bar
5. Choose Full isolation or Selective isolation
6. Enter a comment describing why the device is being isolated
7. Click Confirm and track progress on the Action center page
8. When the device is safe to bring back online, use Release from isolation on the same device page

Impact

• The device is cut off from the network and can no longer communicate with other hosts or attacker infrastructure.
• The device remains connected to Microsoft Defender, so it stays manageable and can be released remotely.
• Full isolation blocks nearly all traffic; Selective isolation allows a limited set of applications to keep working.
• The user loses network access on that device until it is released; communicate the containment if the device belongs to an active user.
• The action only runs on devices onboarded to Microsoft Defender for Endpoint, and isolation must be explicitly reversed with Release from isolation.

Revert

Isolation is reversible, and must be reversed explicitly. It does not expire on its own.

1. Navigate to the Microsoft Defender portal at https://security.microsoft.com
2. Go to Assets > Devices and select the isolated device
3. Click Release from isolation in the action bar
4. Enter a comment recording why the device is being released
5. Confirm, and track the action on the Action center page
6. Confirm with the user that network access has returned

Connectivity is restored within a few minutes once the device processes the action. If the device is offline, the release is queued and applies the next time it checks in to Defender. Nothing else needs restoring: isolation changes no local configuration.

More Information

• Microsoft: Isolate machine API
• Microsoft: Take response actions on a device
• MITRE ATT&CK T1021 – Remote Services (lateral movement)