Lab — Eradication
Eradication and recovery lab on $HUNT_LAB — eradication checklist, recovery plan, validation gate from incident stub.
Visual · t30_eradication_lab
Lab: eradication/recovery pack on YOUR $HUNT_LAB host stub. Original Cyberlium.
Ship eradication-through-validation artifacts from YOUR lab host stub — zero malware authoring or unauthorized prod recovery.
On YOUR $HUNT_LAB per brief: (1) scope proof — post-containment lab host stub linked to Module 7 pack; (2) eradication checklist with validation stubs; (3) recovery plan row with monitoring window; (4) validation checklist with pass/fail criteria; (5) PICERL Eradication→Recovery timeline UTC; (6) integrity — $HUNT_LAB only, defender removal vocabulary not malware how-tos, no unauthorized prod changes; (7) chmod 600 pack. Cross-link containment lab — single incident narrative thread.
1. Lab deliverables
Eradication + recovery + validation — cross-indexed to one lab host incident thread.
Timeline shows PICERL stage transitions with evidence citations.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IR lifecycle — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS — https://www.sans.org/ Splunk ES — https://docs.splunk.com/Documentation/ES
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
echo '=== Eradication lab: PICERL progress ==='
grep -E '\[x\]|\[ \]' "$HUNT_LAB/ir/picerl-checklist.md"
grep -E 'Eradication|Recovery|Validation' "$HUNT_LAB/ir/eradication-LAB-IR-001.md" "$HUNT_LAB/ir/recovery-LAB-IR-001.md" "$HUNT_LAB/ir/validation-checklist-LAB-IR-001.md"
jq -c 'select(.parent=="winword.exe")' "$HUNT_LAB/logs/process-post-recovery.jsonl"═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t30-hunt/ir/eradication-LAB-IR-001.md | Select-String NEVER Get-Content $HOME/cyberlium-lab/t30-hunt/ir/validation-checklist-LAB-IR-001.md | Select-String winword
Primary tools to practice this lesson: grep, jq. Reference sites: IR lifecycle (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS (https://www.sans.org/); Splunk ES (https://docs.splunk.com/Documentation/ES). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Fail loop documented if brief assigns failed check scenario — honest literacy.
Zero malware source or attack repro in pack.
3. Integrity
Validation fraud or prod recovery without RoE = zero credit.
Mentor pack chmod 600.
4. What you ship: eradication lab pack
Eradication + recovery + validation + timeline + integrity — chmod 600.
5. What you record before the next lesson
Eradication lab pack path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Eradication lab includes custom malware source as exhibit.
- Right: Eradication lab pack on $HUNT_LAB host stub. Next: quiz.
Mission: eradication lab
1) Scope and host stub proof. 2) Eradication and recovery rows. 3) Validation checklist. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Fail loop — minimum documentation?”
APPLY: Eradication lab scope:
APPLY: True or False: Malware source files belong in eradication lab.
APPLY: Validation gate prevents: