4.2.2. Containment, Eradication, and Recovery

💡 First Principle: Containment limits blast radius, eradication removes the root cause, and recovery restores operations — performing them out of order guarantees either continued compromise (recovery before eradication) or unnecessary business disruption (containment too broad without scoping first).

Containment

The immediate goal: stop the attacker from causing additional damage while preserving the ability to investigate. Containment must balance security (isolate the threat) against business continuity (keep the business running as much as possible).

Scoping — Before containing, determine the full extent of compromise. Containing System A while System B (which A has already compromised) remains connected means the attacker has a backup foothold. Scoping uses: SIEM log analysis (lateral movement events), EDR telemetry (process execution, network connections from all endpoints), and threat intel (known TTPs of the identified threat actor).

Containment approaches by severity:

Isolation — Full network disconnection of compromised systems. More disruptive than targeted C2 blocking but necessary when the scope of compromise is unclear or the system is actively being used for malicious activity.

Compensating controls during containment — Maintain business operations with alternative systems, manual processes, or reduced-functionality workarounds while primary systems are isolated.

Eradication

Remove all attacker presence: malware, backdoors, persistence mechanisms, compromised accounts, attacker-created files.

• Re-imaging — Most reliable eradication method for compromised endpoints. Wipes the system and reinstalls from a known-good baseline. Preserves hardware; eliminates all software artifacts. Required when rootkits are suspected (firmware-level implants survive re-imaging — those require firmware reflashing or hardware replacement).
• Malware removal — For systems where re-imaging isn't feasible (servers with complex configurations), targeted removal of identified malware components. Higher risk than re-imaging — persistence mechanisms may be missed.
• Credential reset — All accounts that may have been accessed or compromised must have passwords reset and active sessions invalidated. For domain-wide compromises, this may include resetting the KRBTGT account (Kerberos golden ticket defense).
• Patch and harden — Address the initial access vector before recovery. Bringing systems back online with the same vulnerability that enabled the attack invites immediate reinfection.

Recovery

Restore systems and services to normal operations after eradication is confirmed.

• Restore from known-good backups (verifying backups aren't also compromised — backup systems are common attacker targets)
• Phased restoration — Bring back critical systems first, in a controlled manner
• Enhanced monitoring during recovery — Attackers sometimes re-enter during the recovery window when defenders are focused on restoration, not detection
• Validate functionality — Confirm systems operate correctly before removing incident-mode monitoring

⚠️ Exam Trap: Re-imaging guarantees removal of OS and application-level malware — but not firmware-level implants. Sophisticated nation-state attackers can install UEFI/BIOS-level malware that survives OS re-installation. This is rare but represents the upper limit of eradication complexity.

Isolating Affected Targets: Side Effects

NIST warns that handlers should not assume a disconnected host is safe from further damage. Some malware checks its C2 connection and wipes or encrypts the disk when the check fails, and a firewall block looks the same to it as a pulled cable. When analysis reveals a trigger like this, secure memory and critical data first, then isolate with the outcome planned for. Redirecting an attacker into a sandbox to watch them is a recognized form of containment, but NIST says to discuss it with legal first. Knowingly leaving an attacker on production systems can make the organization liable for what they do next.

Containment Judgment Calls

NIST SP 800-61 says the containment strategy depends on criteria such as potential damage, the need to preserve evidence, service availability, time and resources, effectiveness and duration. In practice:

• Safety-critical systems. If isolating a workstation would also cut a patient monitor or other life-safety device, do not default to either extreme. Coordinate with clinical or operational staff: if the device can be moved to alternative monitoring first, isolate the host; if not, contain by other means (block the malware's C2 and lateral-movement paths, restrict the host to the minimum required connections) without severing the device connection.
• Targeted over blanket containment. If a compromised web server is serving malware, block the malicious page or endpoint at the WAF or load balancer so unaffected functions keep running, rather than taking the whole site down or leaving it fully exposed.
• Find persistence before locking out a compromised administrator. An attacker with domain admin access for days has often added backdoor accounts, scheduled tasks or modified GPOs. Search for those first so that disabling the account removes every foothold at once, instead of tipping the attacker off and leaving a way back in. Asking the compromised user to change their own password is not containment.
• Shared accounts. Resetting a shared administrator password cuts off the attacker, but it also locks out every legitimate user of that account at the same moment. Coordinate the reset with the IT staff who depend on it, and replace shared accounts with individual ones afterwards.
• Eradicate now or keep watching. With a long-running intruder (for example a nation-state actor present for months), observation has intelligence value but carries continuing data loss, regulatory notification duties and the risk of a destructive act. The decision belongs to leadership with legal counsel, and possibly law enforcement, not to the SOC alone; no rule always favors one side.

Remediation and Verification

Remediation is not finished when the work is done; it is finished when it is verified:

• Rescan or exploit-test the specific vulnerability that was used.
• Hunt the environment for the incident's indicators, in case the attacker left other footholds before the fix.
• Confirm that exposed credentials were rotated.

A closed change ticket or a version string in an admin console shows that work was done, not that the problem is gone.

Release from Isolation

Release a host back to production only when remediation has been verified and enhanced monitoring is ready for it. Once a resource has been attacked, it is often attacked again. A quiet period inside isolation proves little, because an isolated host has almost no chance to beacon or be attacked.

Performing Restoration

Restore in dependency order: identity and core infrastructure (domain controllers, DNS), then the data tier from verified clean backups, then application servers, and public entry points last. NIST recommends phasing eradication and recovery so that quick, high-value changes come first and longer-term infrastructure changes follow. In a large incident, phasing also lets recovery run alongside eradication across the estate: a system can return once the entry point is closed, it is rebuilt or restored from a verified clean backup, and enhanced monitoring is in place, while cleanup continues elsewhere. No individual system is restored before its own eradication is done.

Reflection Question: During IR, the team confirms eradication and begins recovery. 48 hours after restoring the primary server, C2 communications are detected again. What does this indicate was missed during the eradication phase, and what should the team investigate first?