Quarantine the File

Stopping a process leaves its file in place. If someone launches that file again, the program can return.

Quarantine keeps a file for investigation while preventing new launches from it. On the practice computer:

seclab artifact demo-helper quarantine

You should see:

demo-helper: quarantined; already running processes keep running.

Notice the warning: an already running process keeps running. Quarantine blocks the next launch; it does not stop the current one. Stop it too:

seclab process demo-helper stop

You should see:

demo-helper: stopped.

Check the file’s state:

seclab inspect artifacts demo-helper

Look for these lines:

demo-helper:
  Quarantined: yes

Quarantined says yes. The file and its contents are still available to inspect, but it can no longer launch while it stays quarantined.