Security Operations · Foundational

Eradication

The incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.

Definition

Eradication includes deleting malware, removing persistence, reimaging systems, resetting credentials (including KRBTGT twice for domain compromise), patching exploited vulnerabilities and closing the initial access vector. It must follow thorough scoping.

Related terms