What is Eradication?

Eradication follows containment and requires thorough knowledge of everything the attacker did. Incomplete eradication is one of the most common causes of incident recurrence. Organizations that remove obvious malware while missing a web shell or registry persistence mechanism find themselves responding to the same incident weeks later.

Steps: remove all malware and attacker tools (EDR quarantine plus manual removal), delete all persistence mechanisms (registry keys, scheduled tasks, services, web shells), remove unauthorized accounts or group memberships, reset all potentially exposed credentials (not just known-compromised accounts), patch exploited vulnerabilities, and clean or rebuild systems that cannot be reliably cleaned.

Sometimes the safest approach is system reimaging from a known-good baseline, particularly for systems where the attacker had root or SYSTEM access and may have installed kernel-level implants.

Persistence mechanisms attackers commonly leave behind, and that eradication must specifically hunt for, include: registry Run and RunOnce keys, scheduled tasks or cron jobs disguised with legitimate-looking names, new or modified Windows services, WMI event subscriptions (a stealthy fileless persistence technique that survives reboots without touching disk), web shells dropped in a web application's upload directory, SSH authorized_keys entries added to compromised Linux hosts, and newly created or modified Group Policy Objects that push malicious configuration domain-wide.

Credential reset scope is often broader than it first appears: resetting only the account known to be compromised misses service accounts the attacker may have harvested along the way, cached credentials on systems the attacker touched, and any Kerberos tickets forged if the attacker achieved domain-level compromise, in which case the krbtgt account itself, used to sign all Kerberos tickets, needs its password reset twice to invalidate outstanding golden tickets.

The decision to clean versus reimage a system usually comes down to depth of access achieved: a workstation compromised only at user level, where the malware and persistence mechanisms are fully enumerated, can often be cleaned in place. A server where the attacker obtained SYSTEM or root, especially with any indication of a rootkit or kernel driver, is safer to rebuild from a known-good image, since kernel-level implants can hide from the very tools used to detect them. Verification after eradication typically combines an EDR sweep across the environment for the specific indicators from the incident and a follow-up period of heightened monitoring on previously affected systems.