Academy
TermDefence

Quarantine

Isolating a file or device suspected of being malicious, without deleting it, so that it cannot cause harm.

Flow

  1. 1Isolated
  2. 2Examined
  3. 3Decided
Related families
—
MITRE ATT&CK
T1555.003 · Credentials from Web Browsers
Sources
3 sources
01

Overview

When security software quarantines a file, the file cannot be run but is kept in a state where it can be examined. If it was a false detection, it can be restored. NIST CSRC

Device quarantine cuts the network connection except for security management, stopping the infection from spreading and data from being sent out. MITRE ATT&CK

02

How it works

  1. 1

    Isolated

    The file is moved to a protected folder or the device is disconnected from the network. NIST CSRC

  2. 2

    Examined

    The file is analysed and indicators are extracted.

  3. 3

    Decided

    It is deleted or restored, or the device is cleaned.

03

How to detect it

  • Use quarantine records to search for the same file on other devices. NIST CSRC
04

What to do

  • Even if an infostealer is quarantined, data may already have been sent; change the passwords of accounts saved in the browsers on the device. MITRE ATT&CK
05

MITRE ATT&CK

T1555.003Credentials from Web Browsers
06

Related terms

Terms

Endpoint detection and responseSandboxLeak impact analysis
07

Sources

  1. 1Credentials from Web Browsers (T1555.003) · MITRE ATT&CK
  2. 2Endpoint detection and response — glossary definition · NIST CSRC
  3. 3Filter Network Traffic (M1037) · MITRE ATT&CK