This chapter covers the critical phases of incident eradication and recovery, which are essential for restoring normal operations after a security incident. For the SY0-701 exam, objective 4.8 (Security Operations) specifically tests your understanding of the steps required to remove threats from the environment and safely return systems to production. Mastering these concepts ensures you can differentiate between containment, eradication, and recovery, and apply the correct procedures in scenario-based questions.
Jump to a section
Imagine a chemical spill in a laboratory. The spill is the security incident. First, the hazmat team must contain the spill to prevent it from spreading (containment). But containment alone doesn't make the lab safe again. The team must then remove the spilled chemical entirely (eradication). This involves decontaminating surfaces, disposing of contaminated materials, and ensuring no residue remains. Finally, the lab must be restored to its original state (recovery), which might include repairing damaged equipment, restocking supplies, and verifying air quality before allowing workers back in. In cybersecurity, eradication is the step where you remove all traces of the attacker's presence—deleting malware, closing backdoors, revoking compromised credentials. Recovery is the step where you restore systems to normal operations, often from clean backups, and verify they are secure. Just as a hazmat team cannot skip decontamination and go straight to rebuilding, a security team cannot skip eradication and go straight to recovery. The attacker's persistence mechanisms, like rootkits or scheduled tasks, are the chemical residue—if not fully removed, the incident will recur.
What Are Eradication and Recovery?
Eradication is the phase of incident response where the root cause of an incident is completely removed from the environment. Recovery is the subsequent phase where systems are restored to normal operations. Both are part of the NIST SP 800-61 Incident Response Lifecycle, which includes Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. The SY0-701 exam expects you to know specific eradication and recovery techniques and when to apply them.
How Eradication Works Mechanically
Eradication begins after containment has stopped the incident from spreading. The goal is to eliminate all artifacts of the compromise. This includes: - Malware removal: Using antivirus, EDR tools, or manual removal. - Backdoor closure: Deleting unauthorized user accounts, removing SSH keys, or disabling rogue services. - Vulnerability remediation: Patching the exploited vulnerability (e.g., applying MS17-010 for EternalBlue). - Credential revocation: Resetting passwords for all affected accounts and invalidating session tokens. - System reimaging: In many cases, the most reliable eradication method is to wipe the system and reinstall the OS from a known-good image.
A common mistake is skipping eradication and moving directly to recovery. For example, if an attacker left a scheduled task that re-infects the system, simply restoring from backup without removing that task will lead to reinfection.
Key Components and Standards
NIST SP 800-61 Rev. 2: Defines eradication as 'the process of removing the threat from the environment.'
SANS Incident Response Process: Includes six phases: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.
MITRE ATT&CK: Provides techniques that attackers use for persistence (e.g., T1053 Scheduled Task, T1543 Create or Modify System Process). Eradication must address these specific techniques.
ISO/IEC 27035: International standard for incident management, emphasizing eradication and recovery.
How Attackers Exploit Incomplete Eradication
Attackers often use multiple persistence mechanisms. For example, a common technique is to install a backdoor as a Windows service (T1543.003) and also add a registry Run key (T1547.001). If the incident responder only removes the service but misses the registry key, the attacker can regain access. Another example: after a ransomware attack, attackers may leave behind a scheduled task that re-encrypts files if the ransom is not paid. Eradication must identify and remove all such mechanisms.
Commands and Tools for Eradication
- Windows:
- sc delete <service_name> to remove a malicious service.
- reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MaliciousKey /f to remove a registry run key.
- schtasks /delete /tn "TaskName" /f to delete a scheduled task.
- Linux:
- systemctl disable <service> and rm /etc/systemd/system/<service>.service.
- crontab -e to remove cron jobs.
- kill -9 <PID> and rm -rf /path/to/malware.
- Network: Remove malicious firewall rules using iptables -D or via the firewall management console.
Recovery Phase
Recovery involves restoring data from clean backups, verifying system integrity, and monitoring for signs of residual compromise. Key steps: - Restore from backup: Use offline or immutable backups to avoid restoring compromised data. - Patch and harden: Apply security patches and configuration changes to prevent recurrence. - Test functionality: Ensure the system operates correctly before returning to production. - Monitor: Increase logging and alerting for the affected systems for a period after recovery.
Common Recovery Mistakes
Restoring from a backup that was made after the compromise occurred (i.e., a 'dirty' backup).
Failing to change passwords after recovery, allowing the attacker to log in again.
Not validating the integrity of restored files (e.g., using hash verification).
Post-Incident Activity
After eradication and recovery, conduct a lessons-learned meeting. Update incident response plans, improve detection capabilities, and consider implementing additional controls like application whitelisting or network segmentation.
Exam Relevance
The SY0-701 exam will test your ability to sequence the phases correctly and choose the right eradication or recovery action for a given scenario. For example, you may be asked: 'After containing a malware outbreak on a server, what is the next step?' The correct answer is eradication, not recovery. Another common question: 'Which of the following is the best way to ensure complete removal of malware from a system?' The answer is to reimage the system from a known-good backup.
Summary of Key Points
Eradication removes the root cause; recovery restores operations.
Always verify eradication before beginning recovery.
Use clean backups and validate their integrity.
Document all actions for post-incident review.
1. Identify All Compromised Systems
Before eradication can begin, you must have a complete inventory of affected systems. Use detection tools like SIEM alerts, EDR telemetry, and network logs to identify every host that communicated with the attacker's infrastructure. For example, if a phishing attack led to a workstation compromise, check for lateral movement to other systems. Tools like Wireshark can reveal C2 traffic patterns. This step ensures you don't miss a system that could re-infect the environment.
2. Remove Malware and Backdoors
Use endpoint protection tools (e.g., antivirus, EDR) to scan and remove malicious files. For stubborn malware, boot into safe mode or use a rescue disk. Manually check for persistence mechanisms: scheduled tasks, services, registry run keys, startup folders, and kernel modules. On Linux, check crontab, systemd services, and .bashrc files. Document each artifact removed. If the system is too compromised, plan for reimaging.
3. Revoke Compromised Credentials
Assume all credentials used by the attacker are compromised. This includes user passwords, service accounts, API keys, and certificates. Force password resets for all affected accounts. Revoke and reissue certificates. Invalidate session tokens. If the attacker gained domain admin access, reset the KRBTGT account password twice (a 'golden ticket' mitigation). Use tools like `net user <username> /domain` to reset passwords.
4. Patch Vulnerabilities
Apply security patches for the vulnerabilities exploited during the incident. For example, if the attacker used EternalBlue (MS17-010), ensure all systems have the patch. If a web application was compromised via SQL injection, fix the input validation flaw. Use vulnerability scanners like Nessus or OpenVAS to verify patches. This step prevents the same attack vector from being used again.
5. Restore Systems from Clean Backups
After eradication, restore data from backups known to be clean (taken before the compromise). Verify backup integrity using checksums. On Windows, use `wbadmin start recovery` or a third-party tool. On Linux, use `rsync` or `tar` to restore files. After restoration, apply the latest patches and security configurations. Monitor the system for any signs of residual compromise before returning to production.
Scenario 1: Ransomware Attack on a Hospital
A hospital's file server is encrypted by Ryuk ransomware. After containment (isolating the server via network segmentation), the incident response team proceeds to eradication. They use EDR logs to identify all systems that communicated with the ransomware C2 server. They find that the attacker used a compromised domain admin account. The team resets the KRBTGT password twice and revokes all domain admin credentials. They then reimage the file server from a snapshot taken two weeks prior (verified clean). They apply the latest Windows patches and enable LSA protection. After recovery, they monitor for 72 hours for any signs of reinfection. A common mistake would be to simply restore the server without resetting the domain admin credentials, which would allow the attacker to re-encrypt the server.
Scenario 2: Web Application Breach via SQL Injection
A retail company's e-commerce database is exfiltrated via SQL injection. The incident response team contains the web server by taking it offline. During eradication, they remove the malicious PHP webshell left by the attacker, patch the SQL injection vulnerability in the login form, and reset all database user passwords. They also delete any unauthorized SSH keys added to the server. They then restore the database from a clean backup. After recovery, they deploy a WAF rule to block SQL injection patterns. A common mistake is to patch the vulnerability but not remove the webshell, allowing the attacker to regain access through the backdoor.
Scenario 3: Insider Threat - Data Exfiltration via USB
An employee exfiltrates sensitive data using a USB drive. The incident response team contains the user's workstation and revokes network access. Eradication involves removing any malware the employee may have installed (e.g., a keylogger), disabling the USB port via Group Policy, and resetting the employee's credentials. They then recover the workstation by restoring from a clean image. The team also implements DLP controls to prevent future USB exfiltration. A common mistake is to only disable the USB port without checking for other persistence mechanisms the insider may have used.
The SY0-701 exam tests objective 4.8 by asking you to sequence the incident response phases correctly and select the appropriate eradication or recovery action. Specific sub-objectives include: 'Given a scenario, implement the appropriate eradication and recovery procedures.' You must know the difference between eradication (removing the threat) and recovery (restoring operations). Common wrong answers include confusing eradication with containment. For example, a question might ask: 'After a malware infection, which step involves removing the malware from the system?' Many candidates choose 'containment' because they think containment includes removal, but containment is about stopping the spread, not removal. Another wrong answer is 'recovery' for eradication actions. Candidates often think recovery is the only phase after containment, but eradication must come first. Specific terms: 'reimage' vs 'restore from backup'—reimaging is a clean OS install, while restore from backup returns data. The exam may ask which is more thorough (reimage). Common trick: a question describes a scenario where the attacker used a backdoor. The answer might be 'disable the backdoor service' (eradication) not 'patch the vulnerability' (which is also eradication but may not be the immediate step). Decision rule: If the question asks what to do after containment, the next step is always eradication. If it asks what to do after eradication, the next step is recovery. For scenario questions, look for clues about persistence mechanisms (e.g., 'scheduled task')—that indicates eradication is needed.
Eradication removes the threat; recovery restores operations.
Always eradicate before recovering to prevent reinfection.
Reimaging a system is the most thorough eradication method for a compromised endpoint.
Common persistence mechanisms include scheduled tasks, services, and registry run keys.
Reset the KRBTGT account password twice if domain compromise is suspected.
Use clean backups taken before the compromise for recovery.
Document all eradication and recovery steps for post-incident review.
These come up on the exam all the time. Here's how to tell them apart.
Eradication
Removes the root cause of the incident
Includes malware removal, backdoor closure, credential revocation
Performed after containment
May involve system reimaging or patching
Goal: eliminate all traces of the attacker
Recovery
Restores normal operations
Includes data restoration from backups, system testing, monitoring
Performed after eradication
May involve rebuilding systems or restoring from backup
Goal: return to business as usual
Mistake
Eradication and containment are the same thing.
Correct
Containment stops the incident from spreading; eradication removes the threat. They are distinct phases in the incident response process.
Mistake
Recovery can begin immediately after containment.
Correct
Recovery must be preceded by eradication. If you recover without removing the root cause, the incident will recur.
Mistake
Restoring from backup is always sufficient for eradication.
Correct
Restoring from backup is a recovery step. Eradication involves removing malware, closing backdoors, and patching vulnerabilities before restoring data.
Mistake
Eradication only involves deleting malware.
Correct
Eradication includes removing all artifacts: malware, backdoors, compromised credentials, persistence mechanisms, and vulnerabilities.
Mistake
Once a system is reimaged, eradication is complete.
Correct
Reimaging removes malware from that system, but you must also eradicate other affected systems and revoke compromised credentials across the environment.
Eradication is the phase where you remove all traces of the attacker, including malware, backdoors, and compromised credentials. Recovery is the subsequent phase where you restore systems to normal operations, often by restoring data from clean backups. Eradication must be completed before recovery begins to avoid reinfection.
Reimaging ensures complete removal of all malware and persistence mechanisms, including rootkits that might hide from antivirus. Manual removal may miss hidden artifacts. For the exam, reimaging is the most reliable eradication method for a compromised system.
After eradication, you should proceed to recovery: restore data from clean backups, apply patches, change passwords, and monitor the system for signs of residual compromise. Then return the system to production.
Assume all credentials used by the attacker are compromised. Force password resets for affected accounts, revoke session tokens, and reissue certificates. For domain compromise, reset the KRBTGT account password twice to invalidate golden tickets.
Restoring from a backup that was made after the compromise occurred (a 'dirty' backup). Always verify the backup was taken before the incident and use checksums to ensure integrity.
Patching the vulnerability that was exploited is part of eradication. For example, if the attacker used a known vulnerability like EternalBlue, apply the MS17-010 patch to prevent re-exploitation.
Use EDR tools to scan for residual malware, review logs for any remaining C2 communication, and manually check for persistence mechanisms. Conduct a vulnerability scan to ensure patches are applied. Only then proceed to recovery.
You've just covered Incident Eradication and Recovery — now see how well it sticks with free SY0-701 practice questions. Full explanations included, no account needed.
Done with this chapter?