4.2.2. Containment, Eradication, and Recovery
💡 First Principle: Containment limits blast radius, eradication removes the root cause, and recovery restores operations — performing them out of order guarantees either continued compromise (recovery before eradication) or unnecessary business disruption (containment too broad without scoping first).
Containment
The immediate goal: stop the attacker from causing additional damage while preserving the ability to investigate. Containment must balance security (isolate the threat) against business continuity (keep the business running as much as possible).
Scoping — Before containing, determine the full extent of compromise. Containing System A while System B (which A has already compromised) remains connected means the attacker has a backup foothold. Scoping uses: SIEM log analysis (lateral movement events), EDR telemetry (process execution, network connections from all endpoints), and threat intel (known TTPs of the identified threat actor).
Containment approaches by severity:
| Scenario | Containment Action |
|---|---|
| Single compromised workstation | Network isolation via EDR; VLAN change; disable port on switch |
| Compromised server with active C2 | Block C2 IPs/domains at firewall; isolate from sensitive network segments |
| Ransomware spreading across network | Emergency network segmentation; disable affected VLANs; isolate AD if domain-level compromise |
| Compromised admin credential | Immediate password reset; session invalidation; audit all actions taken with that credential |
| Active attacker in environment | Limit their mobility (block lateral movement paths) without alerting them (they may destroy evidence or escalate) |
Isolation — Full network disconnection of compromised systems. More disruptive than targeted C2 blocking but necessary when the scope of compromise is unclear or the system is actively being used for malicious activity.
Compensating controls during containment — Maintain business operations with alternative systems, manual processes, or reduced-functionality workarounds while primary systems are isolated.
Eradication
Remove all attacker presence: malware, backdoors, persistence mechanisms, compromised accounts, attacker-created files.
- Re-imaging — Most reliable eradication method for compromised endpoints. Wipes the system and reinstalls from a known-good baseline. Preserves hardware; eliminates all software artifacts. Required when rootkits are suspected (firmware-level implants survive re-imaging — those require firmware reflashing or hardware replacement).
- Malware removal — For systems where re-imaging isn't feasible (servers with complex configurations), targeted removal of identified malware components. Higher risk than re-imaging — persistence mechanisms may be missed.
- Credential reset — All accounts that may have been accessed or compromised must have passwords reset and active sessions invalidated. For domain-wide compromises, this may include resetting the KRBTGT account (Kerberos golden ticket defense).
- Patch and harden — Address the initial access vector before recovery. Bringing systems back online with the same vulnerability that enabled the attack invites immediate reinfection.
Recovery
Restore systems and services to normal operations after eradication is confirmed.
- Restore from known-good backups (verifying backups aren't also compromised — backup systems are common attacker targets)
- Phased restoration — Bring back critical systems first, in a controlled manner
- Enhanced monitoring during recovery — Attackers sometimes re-enter during the recovery window when defenders are focused on restoration, not detection
- Validate functionality — Confirm systems operate correctly before removing incident-mode monitoring
⚠️ Exam Trap: Re-imaging guarantees removal of OS and application-level malware — but not firmware-level implants. Sophisticated nation-state attackers can install UEFI/BIOS-level malware that survives OS re-installation. This is rare but represents the upper limit of eradication complexity.
Reflection Question: During IR, the team confirms eradication and begins recovery. 48 hours after restoring the primary server, C2 communications are detected again. What does this indicate was missed during the eradication phase, and what should the team investigate first?
