# Compromised EC2 Instance

### **1. Lock the instance down.**

* **Isolate the compromised instance** and **stop traffic entering or leaving the instance**.<br>
* To do this, **remove the existing security groups from the instance**, and **add a single one that has one egress rule, allowing all traffic to go to 127.0.0.1 only**.

### **2. Take the EBS Snapshot.**

* **Immediately take a snapshot** of the compromised EC2 instance’s EBS volume.<br>
* **Do not shut down the instance**.

### **3. Take a Memory Dump.**

### **4. Perform Forensic Analysis.**

* **Use the EBS Snapshot and the Memory Dump to try to determine what went wrong** and how the instance as compromised.

### **5. Terminate the instance.**
