The behavior described—a user workstation making sequential outbound RDP (port 3389) connection attempts to multiple external IPs with different usernames—is a classic indicator of a compromised host. Malware often turns infected machines into bots that scan and attempt to brute-force RDP on other systems to propagate. Isolating the host is the critical first step to contain the threat and prevent further lateral movement or external attacks originating from your network.

Effective DLP for source code requires a multi-layered strategy targeting different exfiltration vectors. Network DLP inspects content leaving the network, endpoint DLP prevents physical copying via removable media, and version control system (VCS) access controls ensure only authorized personnel can access the code repository itself. This combination directly addresses the data’s movement and access points.

Establishing a secure baseline is a key principle of configuration management. Once a system is hardened, capturing its state (via hashes, images, or configuration management tools) creates a reference point. This baseline is crucial for detecting unauthorized changes through file integrity monitoring (FIM) and for ensuring you can rebuild systems to a known secure state.

The scenario describes a significant deviation from normal behavior (different time, different query patterns—broad `SELECT *` and `INSERT` into temp tables). This is indicative of credential theft and misuse. An attacker who has compromised the service account is using its permissions to extract large volumes of data, likely staging it in temporary tables before exfiltration. The timing outside the normal window and the change in query methodology are key red flags.

To maintain exclusive control and meet strict data sovereignty requirements, the organization must retain ownership and management of the cryptographic keys. The HYOK/CMK model allows the organization to generate, store, and manage keys in its own hardware security module (HSM) or key management service, granting the cloud service temporary key usage rights. This prevents the cloud provider from having persistent access to the unencrypted data.

Volume Shadow Copy is designed specifically for this scenario. It creates point-in-time snapshots of files. Restoring from the most recent VSS snapshot is typically fast, operates at the block level, and minimizes downtime compared to a full tape restore. It is the correct first-line recovery method for accidental deletions on supported systems, assuming snapshots are being taken regularly.

The traffic pattern described is classic DNS: small client queries (to port 53) and larger server responses (from port 53 back to a high client port). While DNS tunneling (option B) is a threat, the question describes a common, legitimate pattern. Without additional anomalies like extremely long subdomains, high query volume, or connections to non-standard ports, the most likely and benign explanation is standard DNS resolution.

Containment is a short-term, tactical phase focused on stopping the bleeding. The goal is to prevent the incident from expanding to other systems, networks, or data. This often involves actions like disconnecting systems from the network, blocking malicious IPs at the firewall, or disabling compromised accounts. Eradication and recovery are subsequent, longer-term phases.

A SOC 2 Type II report is an independent audit performed by a CPA firm that examines the design and operating effectiveness of a service organization’s security, availability, processing integrity, confidentiality, and/or privacy controls over a period of time. It provides objective, detailed evidence of the vendor’s security posture, which is far more reliable than marketing material or verbal assurances.

The behavior described—a user workstation making sequential outbound RDP (port 3389) connection attempts to multiple external IPs with different usernames—is a classic indicator of a compromised host. Malware often turns infected machines into bots that scan and attempt to brute-force RDP on other systems to propagate. Isolating the host is the critical first step to contain the threat and prevent further lateral movement or external attacks originating from your network.0