PPIVTR-D

R. Response (eradicate)

The model with the Eradicate segment of the loop highlighted.
Figure 91
STARTS WHENEvidence collected and preserved.
DONE WHENRerunning the enumeration that found the problem comes back clean.

Contained systems cost money every hour they stay down, and reading disk and memory properly takes days or weeks, so the investigation runs on two tracks at once. Short-form work answers enough to act on. Long-form work carries on for the full TTPs, regulatory reporting, and anything that ends up in front of a court.

The short-form track establishes what the attacker did, how they got in, where else they might be, and what has to go so they cannot come back the same way. The output is rough by design. The source book's tech editor calls it a dirty kebab, which is a fair description of a legitimate deliverable.

Two parallel tracks after containment. Short-form investigation identifies attack methods, maps persistence and scopes the compromise in days to weeks. Long-form investigation performs deep forensics, maps TTPs, engages external parties and reports, over weeks to months.
Figure 92. Agree the scope of both tracks with decision makers, in writing.
Circular process with six stages: remove persistence mechanisms, remediate processes and accounts, rotate credentials, restore systems, remediate vulnerabilities, implement defense in depth.
Figure 108. The six categories of removal work.

Removal, in order

#Item
1Remove persistence. Inventory every mechanism first with its type, system, file or registry path, and associated process. Document each one before deleting it.
2Remediate processes and accounts. Terminate attacker sessions and remove accounts they created.
3Rotate credentials. Everything stolen, including KRBTGT and trust passwords.
4Restore systems. Rebuild where targeted cleanup cannot produce enough confidence.
5Remediate vulnerabilities. The entry point, and anything else exploited during lateral movement.
6Add defense in depth. New control layers against a repeat.

Also

#Item
7Root cause analysis completed rather than symptom removal
8Watchdog processes removed before the components they protect
9Removal verified by rerunning the original enumeration technique
10New indicators found during eradication fed back into scoping

Credential reset phasing

Structure from Table 31, p. 369. The windows come from the book's worked example and need replacing with yours.

PhaseScopeWindow in the example
1KRBTGT, reset twice, then Tier 0 accountsFriday 11 PM to Saturday 3 AM, scheduled maintenance
2Tier 1 accounts and critical service accountsSaturday 6 AM to noon, reduced trading hours
3Tier 2 accounts and remaining service accountsSaturday 2 PM to Sunday 6 PM
Watch out
  • The double KRBTGT reset depends on the interval between resets. Reset once, confirm replication across all domain controllers, then wait longer than the maximum ticket lifetime before the second reset so any existing golden ticket expires. The example allows ten hours.
  • Track every service account with its dependent applications and owner, and have the application team test the credential update in staging before the window. Expect the backup service account to be the one that breaks.
  • Keep emergency access available. Issue short-validity temporary accounts to on-call staff whose credentials are being reset.