CHAPTER 05 30 MIN READ INTERMEDIATE

Eradication: Removing the Threat for Good

Eradication is where containment's temporary fix becomes a permanent one. In PICERL, this is the phase for removing the threat, not just isolating it. Get it wrong and the same attacker walks back in through the same door.

eradication root cause credential rotation persistence removal

What Eradication Actually Requires

Containment stops the bleeding. Eradication closes the wound. Skipping straight to "clean and move on" without addressing how the attacker got in is the single most common reason incidents recur.

Approach	What It Does	What It Leaves Behind
Symptom Removal	Deletes the malicious file, kills the process, removes the obvious artifact	The vulnerability or access path that let the attacker in the first time, still open
Root Cause Removal	Closes the vulnerability, revokes the compromised access, fixes the misconfiguration that was exploited	Nothing exploitable through the same path; attacker has to find a new way in

Note: Containment alone or symptom removal alone leaves the door open. An attacker who re-enters through the same unpatched service or the same stolen credential isn't a new incident. It's the same incident, reopened.

Common Eradication Actions

Eradication actions cluster into a few recurring categories. Most real incidents need more than one at once.

Action Category	Example
Malware and Backdoor Removal	Removing a dropped implant and any secondary payload it staged on disk
Credential and Secret Rotation	Resetting passwords, API keys, and tokens for every account or service touched during the intrusion
Patching the Exploited Vulnerability	Applying the vendor patch or configuration fix for the specific flaw the attacker used to get in
Removing Persistence Mechanisms	Deleting malicious scheduled tasks, registry run keys, or rogue services the attacker set up to survive a reboot

Verifying Eradication

Believing eradication worked and confirming it worked are different things. Verification methods below each catch something self-verification by the same analyst tends to miss.

Verification methods:

Follow-up Scans: catches artifacts the initial cleanup missed, since a single pass rarely finds every dropped file or modified binary.
Monitoring for Recurrence Indicators: catches a return of the same behavior days or weeks later, when a one-time check would already have moved on.
Re-checking Persistence Locations: catches a second or backup persistence mechanism the attacker planted as a fallback in case the first one was found.
Independent Review by a Second Analyst: catches assumptions and blind spots from the analyst who did the eradication work, who is the least likely person to spot their own gap.

When to Rebuild vs Clean

Cleaning saves time. Rebuilding buys certainty. The decision depends on how well the compromise is understood and how much the asset is worth.

Rebuild	Clean-and-Verify
Kernel-level or rootkit compromise	Well-understood, commodity malware
Unknown persistence depth	Clear, complete removal path
High-value asset where certainty matters most	Low-value asset that's easy to reimage later if something was missed

Rule of thumb: when you can't say with confidence exactly what the attacker changed, rebuild. Cleaning a system you don't fully understand just relocates the uncertainty instead of removing it.

Coordinating Eradication Timing Across Systems

When multiple systems are compromised, eradication needs to happen at the same time everywhere, not one system at a time.

Confirm Full Scope

Identify every system, account, and access path the attacker touched before eradicating anything.

→

Prepare All Fixes in Parallel

Stage patches, credential resets, and removal steps for every affected system ahead of time.

→

Execute Simultaneously Across Systems

Trigger eradication on all systems at the same time, so no window exists for the attacker to shift ground.

→

Verify Immediately After

Confirm across all systems at once that the threat is actually gone, not just gone from the first system touched.

Note: Eradicating one system at a time can tip off the attacker the moment the first cleanup lands. They notice access dying on one box and immediately shift to re-establish persistence on the systems not yet cleaned, turning a coordinated takedown into a game of whack-a-mole.

Key Takeaways

Eradication has to address root cause, not just remove the visible symptom, or the same intrusion path stays open.
Common eradication actions cover malware and backdoor removal, credential and secret rotation, patching the exploited vulnerability, and removing persistence mechanisms.
Verification should come from more than one method: follow-up scans, recurrence monitoring, re-checking persistence locations, and independent review all catch different gaps.
Rebuild when the compromise depth is unknown, involves kernel-level access, or the asset is high-value; clean-and-verify when the malware and removal path are well understood.
Simultaneous eradication across all affected systems prevents the attacker from shifting to systems not yet cleaned.
Eradicating one system at a time can tip off the attacker and turn cleanup into an ongoing chase.

Knowledge Check

Click an answer to reveal the explanation.

An analyst deletes a malicious executable from an infected host and closes the incident. A week later, the same host is compromised again through the same unpatched service. What went wrong?

Correct answer: B. Deleting the file addressed the symptom, not the vulnerable service the attacker exploited to deliver it. Without patching that path, reinfection through the same route was only a matter of time.

A forensic review finds a rootkit with kernel-level hooks on a high-value production server, and the full extent of its persistence is unclear. What's the appropriate eradication approach?

Correct answer: B. Kernel-level compromise means the attacker can hide from the same tools used to verify cleanliness, and unknown persistence depth on a high-value asset removes any confidence that a clean scan actually means clean. Rebuilding removes that uncertainty entirely.

A team eradicates malware from one compromised server, then moves on to the next server the following day. Why is this sequencing risky?

Correct answer: B. Cleaning systems one at a time gives an attacker with access to multiple systems a warning sign and time to react on the ones still compromised, which is why simultaneous eradication across the full scope matters.