What Should a SOC Analyst Do First After Discovering Exposed Credentials?

Core Incident Response Priority

When a SOC analyst detects plaintext credentials alongside keylogging artifacts (such as [ENT], [CTRL]c, and [CTRL]v sequences), the immediate threat is active credential compromise. According to the NIST incident response lifecycle and CompTIA Security+ best practices, the highest priority is containment and recovery. Advising the user to change their passwords immediately invalidates the stolen credentials, stopping potential lateral movement and unauthorized access.

Why Reimaging Is Not the First Step

Reimaging the endpoint (Option B) is a vital eradication and recovery measure, but it is not the first action. While some community members correctly note that a persistent keylogger could capture new logins, CompTIA prioritizes neutralizing the active threat vector first. Credential rotation should be performed using a known-clean device, followed by isolation and reimaging. As highlighted by top-voted candidates, securing the account prevents further damage while the technical cleanup proceeds.

Evaluating Distractors

Checking workplace email policies (Option C) addresses compliance rather than security, making it irrelevant to immediate threat mitigation. Reviewing host firewall logs (Option D) may provide forensic context but does nothing to stop active exploitation of the stolen password. The correct sequence is always: contain/secure accounts -> isolate host -> eradicate malware -> recover system.

Community Consensus

The split between Options A and B reflects a common real-world debate, but exam logic strictly follows the "first actionable step" rule. Community experts consistently emphasize that once credentials are exposed, immediate rotation outweighs forensic preservation or system wiping in priority.