SOC › Module 8 › Lesson 1
Eradication Named
Eradication literacy — remove malware access, close persistence paths, patch category — defender vocabulary on $HUNT_LAB stubs, not malware authoring.
Visual · t30_eradication_named
Eradication = named removal rows. $HUNT_LAB. Original Cyberlium.
Opening
Eradication removes the threat — name defender removal steps on YOUR lab stubs, never how to build or deploy malware.
Eradication literacy names: remove malicious files/processes category (EDR quarantine literacy), close unauthorized access paths (revoke keys/sessions from Module 7-3), eliminate persistence (scheduled task/service removal category), patch vulnerable service category, and verify eradication scope against hunt findings. Analyst writes eradication checklist for $HUNT_LAB labeled host — ordered steps, validation hook to Module 8-3, UTC — without writing malware, without 'proving' eradication need via unauthorized deployment, without prod changes without RoE. Cyberlium teaches post-containment defender vocabulary — NOT offensive tooling. Refused: malware authoring, unauthorized prod wipe, disabling logging to hide actions. Lab row: five eradication steps with validation stub each.
1. Named eradication steps
Remove malware, close access, kill persistence, patch, scope verify — five literacy anchors.
Eradication follows Containment — documented in PICERL order.
Command guide
Try these commands — Named eradication steps
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Eradication — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE T1070 — https://attack.mitre.org/techniques/T1070/ (indicator removal context) SANS IR — https://www.sans.org/white-papers/incident-handlers-handbook/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/eradication-LAB-IR-001.md" <<'EOF'
# Eradication Plan — LAB-IR-001 (YOUR lab VM only)
## Objectives
- Remove malicious persistence (documented FAKE indicators)
- Delete unauthorized scheduled tasks / registry keys (lab checklist)
## Steps (lab doc — no malware payloads)
1. Terminate suspicious powershell.exe PID from process.jsonl
2. Remove FAKE_LAB persistence stub (document path)
3. Patch or rebuild WIN-HUNT01 if compromise depth unknown
4. Scan with authorized AV in lab VM
## Validation
- Re-run jq hunt queries — no winword→powershell chain
- No netflow to 203.0.113.99 post-eradication
NEVER: deploy real malware samples; NEVER: Impacket/Mimikatz recipes
EOFCommand — copy this
grep -E 'Eradication|NEVER|powershell' "$HUNT_LAB/ir/eradication-LAB-IR-001.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Eradication (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE T1070 (https://attack.mitre.org/techniques/T1070/); SANS IR (https://www.sans.org/white-papers/incident-handlers-handbook/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender discipline
Cite hunt/EDR stub fields — separate observed IOC from inferred impact.
Preserve evidence row before destructive steps when brief requires.
3. Refused
No malware authoring or deploy; no unauthorized prod eradication.
Eradication literacy supports recovery readiness — not attack facilitation.
4. What you ship: eradication checklist
Five eradication steps + validation stub each + NEVER malware authoring line.
5. What you record before the next lesson
Eradication checklist path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write custom malware then 'eradicate' it on employer workstation without RoE.
Right
Eradication checklist from $HUNT_LAB host stub. Next: Recovery Named.
Mission: eradication checklist
1) Name five eradication steps. 2) Validation stub per step. 3) Apply to one lab host scenario. 4) Write NEVER malware authoring line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Persistence removal — literacy categories?”
Knowledge Check
APPLY: Eradication literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Malware authoring is course lab.
True or False
Knowledge Check
APPLY: Eradication follows:
Multiple choice