During an active engagement, a penetration tester uses Metasploit to exploit a vulnerable service and discovers evidence of an existing, unrelated malware infection with active command-and-control traffic on the compromised host. The rules of engagement include a communication plan for adverse events. What should the tester do first?
- ANotify the designated point of contact per the communication plan before proceeding further
- BContinue testing and document the malware in the final report only
- CShut down the affected host to contain the infection without notifying anyone
- DImmediately remove the malware to protect the client's environment
Show answer & explanationAnswer & explanation
Correct answer: A. Notify the designated point of contact per the communication plan before proceeding further
When testers encounter evidence of a real, pre-existing compromise unrelated to the authorized test, the communication plan in the rules of engagement dictates immediate notification to the designated point of contact so the client can activate incident response. Continuing silently, unilaterally remediating, or shutting down systems without authorization could destroy evidence, cause outages, or exceed the tester's authorized scope.
Why the other options are wrong
- B. Delaying notification allows an active threat to persist and violates adverse event handling expectations.
- C. Unilateral containment actions exceed authorized scope and could cause unintended business impact.
- D. Remediation is outside the tester's authorized scope and could destroy forensic evidence.
Adverse Event Notification via Communication Plan
When testers discover unrelated real-world compromises or critical issues during an engagement, the rules of engagement's communication plan requires prompt notification of the designated point of contact rather than unilateral action.
- Communication plans define escalation contacts and methods
- Testers should not remediate or destroy evidence outside scope
- Prompt notification enables the client's incident response process
Memory trick: Found a fire? Call the fire department, don't grab the hose yourself