Eradication, Recovery, and Lessons Learned

Eradication removes the threat from all affected systems. After containment confirms the scope, eradication ensures no persistence mechanisms remain — malware, backdoors, compromised credentials, or rogue accounts.

Thorough eradication includes:

• Remove all malware and implants identified in investigation
• Delete rogue user accounts and SSH keys added by attacker
• Remove attacker-added cron jobs, registry run keys, scheduled tasks
• Patch the vulnerability that enabled initial access
• Reset all compromised credentials
• Rebuild severely compromised systems from known-good images

For severely compromised systems, rebuilding from a clean image is more reliable than attempting to remove all malware artifacts. Rootkits and persistent implants can survive cleaning attempts. The risk of missing something is too high for critical systems.

After cleaning, verify:

• Re-scan with multiple AV/EDR tools
• Review persistence mechanisms (autoruns, cron, services)
• Check for new user accounts or SSH keys
• Monitor network traffic for C2 callbacks
• Run integrity checks on critical binaries

Recovery restores systems to normal operations safely. Rushing recovery without confirming eradication risks reinfection. Key activities:

• Restore from verified clean backups where needed
• Gradually bring systems back online with enhanced monitoring
• Verify system integrity and proper operation
• Monitor for signs of attacker return

Restoring from backups:

• Verify backup integrity (hash comparison)
• Restore to a clean environment (not the same compromised one)
• Test restored systems before returning to production
• For ransomware: ensure malware is removed before restoring files

After recovery, increase monitoring intensity:

• Enhanced logging on restored systems for 30+ days
• Alert on any activity matching attacker TTPs
• Review network flows for unusual connections
• Re-validate access controls and permissions

The post-incident review (lessons learned) should occur within 1-2 weeks. Attendees: IR team, affected system owners, management. Goal: understand root cause, improve defenses, and update procedures.

RCA asks: why did this happen?

• What was the initial attack vector?
• What controls failed or were missing?
• How long was the attacker present before detection?
• How did the attacker move laterally?
• What data was accessed or exfiltrated?

Key IR metrics to track:

• MTTD — Mean Time to Detect
• MTTR — Mean Time to Respond/Recover
• MTTC — Mean Time to Contain
• Number of affected systems
• Data exposure scope

Lessons learned output:

• Update IR playbooks with new TTPs observed
• Deploy missing detection capabilities
• Patch identified vulnerabilities
• Schedule training on gaps identified
• Update communication templates

Why is rebuilding a severely compromised system from a clean image often preferred over attempting to clean it?

Eradication removes all attacker artifacts: malware, backdoors, rogue accounts, and C2 persistence. For severely compromised systems, rebuild rather than clean. Recovery restores operations from verified clean backups with enhanced monitoring. Post-incident review identifies root cause, measures MTTD/MTTR, and improves future response through updated playbooks and new detections.