https://redbeardsec.com/incident-response-containment-phase-3/