Overview
Eradication is the phase where the cause of the incident is fully removed from the environment — the malware, the attacker's access, and the vulnerability that allowed it. Skipping or rushing eradication is how organizations get reinfected days later.
Learning objectives
- Explain the goal of eradication.
- Identify what must be removed.
- Understand why root-cause removal is essential.
Core concept
Eradication eliminates the incident's root cause and all attacker artifacts. That means removing:
- Malware and any dropped tools.
- Attacker persistence — backdoors, scheduled tasks, startup entries, rogue accounts, altered configurations.
- Attacker access — resetting compromised credentials, revoking stolen tokens/keys.
- The underlying vulnerability — patching or reconfiguring whatever allowed the initial compromise.
How it works
Eradication depends on thorough analysis (to know everything the attacker touched) and often on rebuilding rather than cleaning: because sophisticated malware and rootkits hide, restoring a system from a known-good image is frequently safer than trying to remove every trace by hand. Crucially, eradication must address the root cause — if the entry vulnerability is not fixed and all footholds are not removed, the attacker simply returns.
Practical example
After containing a ransomware incident, the team rebuilds the affected servers from clean images (rather than trusting a "cleaned" system), resets all potentially exposed passwords, revokes API keys the attacker could have taken, and patches the unpatched service that provided initial access. Only after every foothold and the root vulnerability are gone is the environment considered clean.
Cybersecurity relevance
Eradication is where thorough analysis pays off and where the "verify" discipline matters: responders confirm that no persistence remains before moving to recovery. Incomplete eradication is a common cause of repeat incidents, sometimes worse than the first.
Common mistakes
- Removing the obvious malware but missing persistence (a backdoor or rogue account), so the attacker returns.
- Not fixing the root-cause vulnerability, inviting the same attack again.
- Cleaning instead of rebuilding when malware may be deeply embedded.
Key takeaways
- Eradication removes malware, attacker persistence and access, and the root-cause vulnerability.
- It relies on thorough analysis and often on rebuilding systems from known-good images.
- Incomplete eradication (missed footholds or unpatched cause) leads to reinfection.
Check your understanding
- List the categories of things that must be removed during eradication.
- Why is rebuilding from a clean image often safer than "cleaning" an infected system?