Eradication - NIST 800-61 Incident Response Phase

Eradication is the NIST SP 800-61 incident response phase in which the adversary's persistence mechanisms, malware, accounts, and access methods are removed from affected systems. Eradication follows containment and precedes recovery; it is distinct from both. Immature programs frequently skip directly from containment to recovery without proper eradication, which is one of the most common reasons for re-infection.

What Eradication Removes

• Malware and adversary tools on affected systems
• Adversary-created accounts, including service accounts and OAuth applications
• Modified credentials (passwords, keys, tokens, secrets)
• Persistence mechanisms (scheduled tasks, services, registry keys, startup folders, BIOS or firmware implants)
• Adversary network footholds (VPN sessions, RMM tools, reverse shells, backdoors)
• Adversary-modified configurations (firewall rules, IAM policies, conditional access exceptions)

Eradication Strategies

For most modern intrusions, full eradication on a compromised endpoint requires a rebuild from known-good images rather than cleanup in place. Cleanup-in-place is acceptable only for narrow-scope compromises with well-understood persistence and verified removal. For Active Directory or identity-provider compromise, eradication often requires forest-level remediation or migration to a new tenant.

Eradication Validation

Eradication is not complete until validated. Validation includes:

• Confirmation that all known persistence mechanisms have been removed
• Hunting for residual indicators across the environment (not just the affected systems)
• Re-imaging or rebuilding compromised systems from known-good images
• Credential rotation across affected and dependent systems
• Verification that detection content for the observed TTPs is in place to catch re-entry