The prerequisites and process of incident eradication
The goal of the incident eradication phase is to remove intrusion signs from the organization. By now, the IR team has a certain assurance of successful containment, as no new signs of uncontrolled/unknown malicious behavior are taking place. Moreover, the analysts should preserve all digital evidence, hence all adversaries’ foothold, so it can be removed.
Notably, this part of incident handling covers removing all malicious indicators from the organization. Rollback actions (for example, reverting to the initial state) are a part of incident recovery. The eradication actions require a similar toolset as during the containment step: AV, EDR, NGFW, Windows PowerShell, batch scripts, email security and administration toolkit, and so on. Let’s determine the possible actions while referencing a similar methodology:
- The generic actions list:
- Report incidents to external companies: This means that IOCs and IOAs...
