Overview
Eradication is the phase where the SOC removes the threat from the environment — eliminating the attacker's access, malware, and footholds — so the incident cannot simply resume once systems are restored.
Learning objectives
- Define eradication and how it differs from containment.
- Identify what must be removed to fully eradicate a threat.
- Explain why root-cause understanding is essential before eradication.
Core concept
Eradication removes the root cause and all attacker artifacts from the environment after containment has stopped active spread. Where containment limits the threat, eradication eliminates it: removing malware, deleting persistence mechanisms (module 12), closing the initial access vector (e.g. patching the exploited vulnerability or fixing the misconfiguration), and revoking any attacker-controlled access. Eradication depends on understanding the incident thoroughly — the full scope and how the attacker got in — because removing symptoms while leaving the root cause or a hidden foothold lets the attacker return. It precedes recovery: you eradicate the threat, then restore systems to normal, in that order, so that recovery does not simply bring a still-compromised system back online.
How it works
With the incident contained, the SOC works to eliminate the threat everywhere it exists. Using investigation findings (EDR process trees, logs, IOC pivoting), it removes malware and persistence (scheduled tasks, services, registry autoruns, rogue accounts — the indicators from module 12) from every affected system. It closes the entry point — patching the exploited vulnerability, correcting the misconfiguration, or resetting the abused credentials — so the same vector cannot be reused. Often the most reliable eradication is to rebuild affected systems from known-good images rather than trying to clean them in place, especially when the extent of compromise is uncertain. Throughout, the SOC relies on complete scope from identification: any missed host or foothold undermines eradication. Only once the threat is confirmed removed does the process move to recovery (next lesson). Understanding root cause here also feeds the lessons-learned phase.
Practical example
After containing the three-host incident, the SOC eradicates. Investigation showed the attacker entered via an unpatched vulnerability and established persistence via a scheduled task on each host. The team rebuilds all three hosts from clean images (removing malware and persistence entirely), patches the vulnerability that provided initial access so it cannot be reused, and confirms the previously disabled account is fully remediated (credentials reset). It verifies no persistence remains anywhere in scope. Because eradication removed the root cause (the vulnerability) and all footholds — not just the visible malware — the attacker cannot regain access when systems return in recovery. Had they only deleted the malware but left the vulnerability, the environment would be re-compromised almost immediately.
Cybersecurity relevance
Eradication is where the incident is truly ended: it eliminates the attacker's malware, persistence, and access, and closes the root-cause entry vector so the incident cannot resume. It depends on the investigation and scope from identification and on the persistence/malware knowledge from earlier modules, and it must complete before recovery to avoid restoring a compromised system. Incomplete eradication — leaving a foothold or the original vulnerability — is a leading cause of repeat incidents. Done well, it sets up a clean recovery and a root-cause understanding that strengthens defenses in lessons learned.
Common mistakes
- Removing symptoms, not root cause — deleting malware but leaving the vulnerability or misconfiguration that allowed entry.
- Missing persistence or a foothold, so the attacker quietly regains access after recovery.
- Recovering before eradicating, bringing a still-compromised system back online.
Key takeaways
- Eradication eliminates the threat: malware, persistence, and the root-cause access vector are all removed.
- It requires thorough understanding of scope and root cause; rebuilding from known-good images is often the most reliable approach.
- Eradication must complete before recovery, or restored systems may still be compromised.
Check your understanding
- How does eradication differ from containment, and what must be removed for it to be complete?
- Why is closing the root-cause access vector as important as removing the malware itself?