Please enable JavaScript.
Coggle requires JavaScript to display documents.
4️⃣ ERADICATION PHASE 🧹 - Coggle Diagram
4️⃣ ERADICATION PHASE 🧹
🎯 Purpose of Eradication
Remove attacker presence from the environment
Eliminate malware, persistence mechanisms, and unauthorized access
Close exploited vulnerabilities
Remove compromised accounts and credentials
Restore secure system configuration
Prepare system for Recovery Phase
🧠 What is Eradication?
Eradication means completely removing the root cause of the security incident
It is performed after:
Detection
Analysis
Containment
Example:
Attacker created malicious user
Attacker installed malware
Attacker added SSH backdoor
Eradication removes all attacker access
🏢 Enterprise Eradication Workflow
1️⃣ Confirm Incident Scope 🔍
Identify affected Linux servers
Collect information:
Hostname
IP Address
Operating System Version
Running Services
User Accounts
Installed Packages
Commands:
hostnamectl
ip addr
uname -a
cat /etc/os-release
systemctl --type=service
rpm -qa
Documentation:
Incident ticket
Timeline
Evidence record
2️⃣ Malware Removal 🦠
Identify malicious files
Common malware locations:
/tmp
/var/tmp
/dev/shm
/etc/cron.d
/etc/systemd/system
User home directories
Search suspicious files:
find /tmp -type f
find /dev/shm -type f
find / -mtime -1
ls -lah /tmp
Check running processes:
ps aux
top
htop
Check suspicious network connections:
ss -tulpn
netstat -tulpn
lsof -i
Remove malware:
Stop malicious process
kill PID
Remove malicious file
rm -f filename
3️⃣ Remove Persistence Mechanisms 🔐
What is Persistence?
Technique used by attackers to maintain access
Survives reboot or logout
Check SSH Backdoors
Location:
~/.ssh/authorized_keys
/root/.ssh/authorized_keys
Commands:
cat ~/.ssh/authorized_keys
ls -la ~/.ssh
Remove unauthorized SSH keys:
Edit:
/home/user/.ssh/authorized_keys
Check Cron Persistence
Cron locations:
/etc/crontab
/etc/cron.d/
/etc/cron.daily/
User crontab
Commands:
crontab -l
cat /etc/crontab
Check Systemd Persistence
Location:
/etc/systemd/system/
Commands:
systemctl list-unit-files
systemctl list-timers
Remove malicious services
systemctl stop service_name
systemctl disable service_name
rm /etc/systemd/system/service_name
4️⃣ Account Security Remediation 👤
Identify compromised users
Check users:
cat /etc/passwd
last
lastlog
Check sudo abuse:
cat /etc/sudoers
ls /etc/sudoers.d/
visudo
Remove malicious users:
userdel username
userdel -r username
Reset passwords:
passwd username
Lock account:
usermod -L username
5️⃣ Patch Vulnerabilities 🔧
Identify vulnerable software
Commands:
rpm -qa
yum updateinfo
apt list --upgradable
Apply security updates:
RHEL:
yum update --security
Ubuntu:
apt update && apt upgrade
Verify patch status
6️⃣ File Integrity Verification 📁
Check system file changes
Tools:
AIDE
Tripwire
OSSEC
AIDE Commands:
aide --check
aide --init
Compare against known good baseline
7️⃣ Rootkit Detection 🕵️
Rootkit = Hidden malicious software
Tools:
rkhunter
chkrootkit
OSSEC
Commands:
rkhunter --check
chkrootkit
8️⃣ Credential Rotation 🔑
Change compromised passwords
Rotate SSH keys
Rotate API keys
Rotate service accounts
Update secrets in Vault/PAM
9️⃣ SELinux Security Validation 🛡️
Check SELinux status:
getenforce
Enable enforcing mode:
setenforce 1
Check suspicious contexts:
ls -Z
Restore labels:
restorecon -Rv /
🔟 Eradication Validation Checklist ✅
Malware removed
Backdoors removed
Unauthorized accounts removed
Passwords rotated
Vulnerabilities patched
Logs reviewed
File integrity verified
System ready for Recovery
➡️ Next Phase
5️⃣ Recovery Phase 🔄
Restore services
Monitor systems
Validate security controls
Return production safely