Eradication Named
Eradication literacy — remove threat access, close persistence paths, patch root cause — defender vocabulary on YOUR `$IR_LAB` tabletop stubs only.
Visual · t34_eradication_named
Eradication = named removal rows. $IR_LAB tabletop. Original Cyberlium.
Containment stops spread — eradication removes the threat — name eradication checkpoints on YOUR lab tabletop before unauthorized prod changes without RoE.
Eradication literacy names defender removal work: close attacker access paths category, remove persistence stubs category, patch or mitigate root vulnerability category, rotate compromised credentials category, and validate no re-entry before recovery category. Analyst documents eradication checklist on `$IR_LAB` instructor ransomware tabletop stub — maps each row to prior containment decisions from Module 5 — without deploying malware to 'need' eradication, without unauthorized prod AD or endpoint wipes, without attacker persistence cookbooks. Cyberlium teaches PICERL Eradication phase vocabulary on YOUR labeled notes under $HOME/cyberlium-lab/t34-ir/ — defender decision literacy only. Refused: prod eradication without ticket, malware authoring, lateral movement repro. Lab row: five eradication checkpoints with UTC and owner stub per row. chmod 600.
1. Named eradication checkpoints
Close access, remove persistence, patch root cause, rotate credentials, validate no re-entry — five literacy anchors.
Each checkpoint cites observed scope from Identification — not guesswork.
Command guide
Try these commands — Named eradication checkpoints
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Containment → eradication handoff
Containment limits blast radius; eradication removes footholds documented on lab stub.
Link Module 5 containment decision rows — same incident thread UTC.
3. $IR_LAB boundary
Eradication notes from YOUR tabletop scenario stubs only — not unauthorized prod changes.
Refused: malware deploy, persistence how-tos, prod wipe without RoE.
4. What you ship: eradication checklist
Five eradication checkpoints + owner stub + UTC + NEVER unauthorized prod eradication line.
5. What you record before the next lesson
Eradication checklist path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Wipe random employer endpoints without ticket as 'eradication practice.'
- Right: Eradication checklist from `$IR_LAB` tabletop stub. Next: Recovery Named.
Mission: eradication checklist
1) Name five eradication checkpoints. 2) Map each to containment row from Module 5. 3) Owner stub and UTC per row. 4) Write NEVER unauthorized prod eradication line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Eradication vs Recovery — literacy boundary?”
APPLY: Eradication literacy on Cyberlium uses:
APPLY: True or False: Malware authoring belongs in eradication lab.
APPLY: Eradication checkpoints include:
Recovery Named
Part of Incident Response with AI — Eradication and Recovery.
Validation Checks
Part of Incident Response with AI — Eradication and Recovery.
Lab — Eradication
Part of Incident Response with AI — Eradication and Recovery.