Eradication

Eradication: Technical Examples

---

1. Purpose of Eradication

Purpose: To completely remove the root cause of the incident, eliminate all traces of the adversary, and ensure that systems are free from malicious artifacts.

• Why: Without thorough eradication, remnants of the attack (e.g., malware, backdoors, or compromised accounts) can allow attackers to regain access, rendering containment efforts ineffective.

---

2. Key Activities in Eradication

Below are the primary activities involved in the eradication stage, along with technical examples for each:

---

1. Malware Removal

• Purpose: To identify and remove malicious software from compromised systems.

• Why: Malware is often the primary tool used by attackers to maintain persistence or escalate privileges.

• Technical Example:

  • Use antivirus or EDR tools to detect and remove malware:

    Get-MDATPMachineAction -MachineId <MachineID> -ActionType "RunAntiVirusScan"

  • Manually delete malicious files and terminate associated processes:

    rm /path/to/malicious_file
    kill -9 <PID>

---

2. Rebuilding Systems

• Purpose: To ensure that compromised systems are completely clean by rebuilding them from scratch.

• Why: Rebuilding ensures that no hidden backdoors or residual artifacts remain on the system.

• Technical Example:

  • Reimage a compromised server using automation tools like Packer or Ansible:

    packer build server_template.json
    ansible-playbook -i inventory.yml rebuild_server.yml

  • Example Ansible Playbook (rebuild_server.yml):

    - hosts: servers
      tasks:
        - name: Reimage the server
          shell: reimage_tool --server {{ inventory_hostname }}

---

3. Restoring from Backup

• Purpose: To restore impacted systems to a known good state using backups.

• Why: Backups provide a clean baseline to recover data and functionality without reintroducing malicious artifacts.

• Technical Example:

  • Restore a database from a backup:

    RESTORE DATABASE SQLServerDB FROM DISK = '/backups/SQLServerDB.bak' WITH REPLACE;

  • Verify the integrity of restored data:

    md5sum /restored_data/file.txt

---

4. Applying Additional Patches

• Purpose: To address vulnerabilities that were not immediately patched during containment but may still pose a risk.

• Why: Patching ensures that systems are protected against known exploits, reducing the likelihood of re-exploitation.

• Technical Example:

  • Apply missing patches using package managers:

    sudo apt-get update && sudo apt-get upgrade

  • Use tools like WSUS or SCCM to deploy patches across Windows environments:

    Approve-WsusUpdate -Update (Get-WsusUpdate -Classification "Security Updates") -Action Install -TargetGroupName "All Computers"

---

5. System Hardening

• Purpose: To reduce the attack surface of systems and networks by implementing additional security measures.

• Why: Hardening minimizes the risk of future incidents by addressing misconfigurations and enforcing best practices.

• Technical Example:

  • Disable unnecessary services:

    systemctl disable unused_service
    systemctl stop unused_service

  • Configure host-based firewalls to block unnecessary traffic:

    New-NetFirewallRule -DisplayName "Block SMB" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block

  • Enable Attack Surface Reduction (ASR) rules in Microsoft Defender:

    Add-MpPreference -AttackSurfaceReductionRules_Ids <RuleID> -AttackSurfaceReductionRules_Actions Enabled

---

3. Extending Containment Activities

Purpose: To reinforce containment measures by implementing additional safeguards during eradication.

• Why: Strengthening defenses during eradication ensures that attackers cannot exploit remaining vulnerabilities.

• Technical Example:

  • Update firewall rules to block newly identified malicious IPs:

    iptables -A INPUT -s 10.0.0.10 -j DROP

  • Deploy intrusion detection/prevention systems (IDS/IPS) across the network:

    snort -c /etc/snort/snort.conf -i eth0

---

4. Network-Wide Hardening

Purpose: To apply hardening measures across the entire network, not just impacted systems.

• Why: Attackers often exploit weak points in the broader network, so network-wide hardening reduces the overall risk.

• Technical Example:

  • Segment critical systems into isolated VLANs:

    vlan 10
    name CriticalSystems
    exit
    interface GigabitEthernet0/1
    switchport access vlan 10

  • Enforce strong password policies across all systems:

    Set-ADDefaultDomainPasswordPolicy -Identity domain.local -MinPasswordLength 15 -ComplexityEnabled $true

---

Conclusion

Eradication is a critical step in ensuring that the root cause of an incident is fully addressed and that all traces of the adversary are removed. By removing malware, rebuilding or restoring systems, applying patches, and implementing system-hardening measures, organizations can eliminate the risk of re-exploitation.