Incident › Module 6 › Lesson 4
Lab — Eradication
Eradication and recovery lab on `$IR_LAB` — eradication checklist, recovery plan, validation gates bundled.
Visual · t34_eradication_lab
Lab: eradication/recovery pack on YOUR $IR_LAB tabletop stub. Original Cyberlium.
Opening
Ship eradication and recovery artifacts from YOUR tabletop stub — checklist, recovery plan, validation gates — zero unauthorized prod changes or malware repro.
On YOUR `$IR_LAB` per brief: (1) scope proof — tabletop scenario name and containment rows from Module 5 labeled; (2) eradication checklist Module 6-1; (3) recovery plan row Module 6-2; (4) validation gate checklist Module 6-3; (5) UTC timeline stub linking containment → eradication → recovery → validation; (6) integrity — `$IR_LAB` only, no unauthorized prod changes, no malware deploy, no decryptor crime how-tos; (7) chmod 600 pack. Cross-link Modules 1–5 IR work — professional PICERL Eradication/Recovery literacy, not offensive cookbooks.
1. Lab deliverables
Eradication + recovery + validation cross-indexed to one tabletop scenario.
Timeline cites prior containment decisions — not fabricated narrative.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/eradication/eradication-lab-summary.md" <<'EOF'
# Eradication & Recovery Lab Summary — YOUR lab
- eradication-named.txt: remove, patch, rotate, rebuild
- recovery-named.txt: backup restore, staged return, RTO/RPO
- validation-checklist.md: post-recovery verification
## Refusals
- No ransomware builders; no payment how-to
EOFCommand — copy this
grep -E 'validation-checklist|Refusals|payment' "$IR_LAB/eradication/eradication-lab-summary.md" ls "$IR_LAB/eradication/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/eradication/validation-checklist.md | Select-String persistence
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites lab stub source — not generic IR blog advice.
Zero unauthorized prod change notes or malware repro references.
3. Teardown
Secure notes chmod 600; no lab actions pushed to prod ticketing without approval.
Archive stub optional per brief.
4. What you ship: eradication lab pack
Eradication + recovery + validation + timeline + integrity — chmod 600.
5. What you record before the next lesson
Eradication lab pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Eradication lab includes malware persistence walkthrough as deliverable.
Right
Eradication lab pack on `$IR_LAB` tabletop stub. Next: quiz.
Mission: eradication lab
1) Scope and tabletop stub proof. 2) Eradication checklist and recovery plan. 3) Validation gate checklist. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum timeline entries if brief sparse?”
Knowledge Check
APPLY: Eradication lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Malware deploy belongs in eradication lab.
True or False
Knowledge Check
APPLY: Eradication lab pack should:
Multiple choice