When designing an automated SOAR playbook to minimize dwell time in a ransomware incident with anomalous privileged service accounts, which action should be included?

• A. Revoke OAuth tokens and suspend sessions for high-privilege accounts based on entity risk.
• B. Add an approval step before containment action.
• C. Create an external API call to VirusTotal to submit hashes.
• D. Add a YARA-L rule alerting on scripts (e.g., wscript.exe).

Answer: (A)

In ransomware incidents involving privileged service accounts, the fastest way to cut off the attacker’s access and reduce dwell time is to automatically invalidate credentials and suspend sessions for those high-risk accounts. Revoke OAuth tokens and suspend sessions stops ongoing authentication and prevents further use of those accounts to move laterally, access resources, or deploy further encryption. Because this action is automated and based on risk signals, it minimizes delay, which is crucial when time is of the essence in containment.

Consider that waiting for approvals or adding steps that slow down response delays containment and can allow additional encryption or damage. Submitting hashes to VirusTotal is an intel-gathering step, not an immediate containment action, and adding a YARA-L rule is detection-oriented and may not immediately stop the attacker’s access, especially for privileged service accounts. The focus here is on rapidly neutralizing the attacker’s foothold by taking away credentials used to access critical systems.