Isolate the Line Controller?

Contain now, and contain in a scoped way rather than a total blackout.

• The beacon has been running for six hours. Every hour of delay is another hour of hands-on-keyboard access, and the SMB attempts show the actor is already looking for a path off the workstation. The plant manager is weighing $40,000/hour against an unbounded loss; that comparison is not close.
• Safety, not just data. This host programs PLCs on a food line. An adversary with Cobalt Strike and an engineering workstation is one step from altering a recipe, disabling an interlock, or pushing firmware. Product integrity and physical safety outrank the schedule.
• Scope the containment. If EDR supports selective rules, block the host's corporate- and internet-facing traffic while preserving the OT-local control path. If containment is all-or-nothing, contain anyway and tell operations to stop the line in an orderly way - cheaper than an unplanned mid-cycle stop.
• Route it through an incident commander, not the plant manager. Declare an incident, page the retainer, and let the IC own the business tradeoff with a named risk owner. Your job is to give a clear recommendation and the evidence behind it.
• If overruled, record the objection, the request, and who made it. Apply the next-best controls: block the C2 IP at the egress firewall, alert on the SMB fan-out pattern, and put the three target hosts under heightened monitoring.

Follow order of volatility, and get authorization before imaging.

1. Memory first. Cobalt Strike lives in memory; a reboot or shutdown destroys the beacon configuration, keys, and injected code. Capture the full memory image over the network if the tooling allows.
2. Network state. Connection table, DNS cache, ARP, and the C2 IP/domain. Pull the EDR process tree and command lines, and export the raw telemetry from the console so it survives console retention limits.
3. Logs. Firewall and proxy logs for the C2 address across the entire estate - this is how you find the other victims - plus AD authentication events for the host's account and any engineering-software logs.
4. Disk. Forensic image before any cleanup or reimaging.
5. Chain of custody. Hash every artifact, record who collected what and when, and retain the original media.

The production constraint is solvable: build a replacement workstation from a known-good image and swap it in. That returns the line faster than 'cleaning' the original and keeps the evidence intact. Notify legal to issue a preservation hold before anything is deleted.

Change, in order:

• Egress control. Permit only sanctioned resolvers, allow port 443 to approved destinations, and remove direct-to-internet paths from the engineering VLAN. The workstation should never have had a route to an arbitrary external IP.
• Engineering workstation hardening. No email or browsing on the host that programs PLCs; application allowlisting so user-writable paths cannot execute unknown binaries; remove local admin from the engineering user.
• Detection. Alert on new external IPs contacted from OT segments, on SMB connection fan-out from a single host, and on periodic beacon-timing patterns.
• Rebuild and baseline the workstation from a verified image, then review what persisted.

Do not change yet:

• Do not re-architect OT segmentation in the middle of an active incident. Segmentation is the right destination, but it belongs in a planned change at a maintenance window, not an emergency cutover while containment is still underway.
• Do not roll out broad TLS decryption to chase DoH overnight. It breaks pinned applications and adds noise during the response; the egress restriction already closes the path, and decryption can be scoped deliberately once the incident is closed.

The general principle: close the specific path now with reversible changes, and schedule the architectural fix on its own timeline with a test plan.