Incident › Module 6 › Lesson 1
Eradication Named
Eradication literacy — remove threat access, close persistence paths, patch root cause — defender vocabulary on YOUR `$IR_LAB` tabletop stubs only.
Visual · t34_eradication_named
Eradication = named removal rows. $IR_LAB tabletop. Original Cyberlium.
Opening
Containment stops spread — eradication removes the threat — name eradication checkpoints on YOUR lab tabletop before unauthorized prod changes without RoE.
Eradication literacy names defender removal work: close attacker access paths category, remove persistence stubs category, patch or mitigate root vulnerability category, rotate compromised credentials category, and validate no re-entry before recovery category. Analyst documents eradication checklist on `$IR_LAB` instructor ransomware tabletop stub — maps each row to prior containment decisions from Module 5 — without deploying malware to 'need' eradication, without unauthorized prod AD or endpoint wipes, without attacker persistence cookbooks. Cyberlium teaches PICERL Eradication phase vocabulary on YOUR labeled notes under $HOME/cyberlium-lab/t34-ir/ — defender decision literacy only. Refused: prod eradication without ticket, malware authoring, lateral movement repro. Lab row: five eradication checkpoints with UTC and owner stub per row. chmod 600.
1. Named eradication checkpoints
Close access, remove persistence, patch root cause, rotate credentials, validate no re-entry — five literacy anchors.
Each checkpoint cites observed scope from Identification — not guesswork.
Command guide
Try these commands — Named eradication checkpoints
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA Stop Ransomware — https://www.cisa.gov/stopransomware SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/eradication/eradication-named.txt" <<'EOF'
Eradication steps — NAMED LITERACY (authorized systems only):
Remove malware: delete payloads, kill persistence (scheduled tasks, services)
Patch vulnerability: apply vendor fix for initial access vector
Rotate credentials: all accounts touched by attacker scope
Rebuild if uncertain: wipe + restore from known-good backup
Validate: scan clean; compare hashes to baseline
NEVER: deploy ransomware builders; test malware on stranger networks
Lab: write eradication plan bullets for LAB-IR-RANSOM-001 tabletop
EOFCommand — copy this
grep -E 'Remove malware|Rotate credentials|NEVER|tabletop' "$IR_LAB/eradication/eradication-named.txt" curl -sS https://www.cisa.gov/stopransomware/ransomware-guide | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Containment → eradication handoff
Containment limits blast radius; eradication removes footholds documented on lab stub.
Link Module 5 containment decision rows — same incident thread UTC.
3. $IR_LAB boundary
Eradication notes from YOUR tabletop scenario stubs only — not unauthorized prod changes.
Refused: malware deploy, persistence how-tos, prod wipe without RoE.
4. What you ship: eradication checklist
Five eradication checkpoints + owner stub + UTC + NEVER unauthorized prod eradication line.
5. What you record before the next lesson
Eradication checklist path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Wipe random employer endpoints without ticket as 'eradication practice.'
Right
Eradication checklist from `$IR_LAB` tabletop stub. Next: Recovery Named.
Mission: eradication checklist
1) Name five eradication checkpoints. 2) Map each to containment row from Module 5. 3) Owner stub and UTC per row. 4) Write NEVER unauthorized prod eradication line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Eradication vs Recovery — literacy boundary?”
Knowledge Check
APPLY: Eradication literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Malware authoring belongs in eradication lab.
True or False
Knowledge Check
APPLY: Eradication checkpoints include:
Multiple choice