Incident Response and Digital Forensics
Eradication and Recovery
We remove all persistence points left by the attacker in a single coordinated action. Systems are restored in dependency order under monitoring.
What it is
Eradication means removing everything that could allow the attacker back in. Newly created accounts, scheduled tasks, web shells, and stolen passwords are included. If clean-up is done in parts, the attacker is alerted and may continue by another route. Safe recovery means restoring systems in the correct order, starting with identity infrastructure.
Scope
- Compiling the complete list of persistence points from evidence
- Planned reset of privileged account passwords, including krbtgt
- Identifying which critical systems to rebuild from a clean source
- Closing the entry point before systems are restored
- Restoring systems in dependency order
- Intensive monitoring after recovery
The need
When organizations need it
- When the same signs reappear a few days after the attacker was thought to be removed.
- When, after a ransomware attack, it is unclear whether Active Directory can be trusted.
- When business units want immediate restoration and a safe order must be set.
Method
How we work
-
Inventory
We list every persistence point and compromised identity from the evidence.
-
Plan
We plan the clean-up for a single time window and identify systems to be rebuilt.
-
Execution
We remove all access simultaneously, close the entry point, and reset passwords in a planned sequence.
-
Monitored recovery
We restore systems in dependency order and closely monitor for signs of re-entry.
Outcome
What you have at the end
All known attacker access is removed and the entry point is closed. Systems are restored in the correct order and any re-entry attempt is monitored.
Frequently asked questions
Is it better to clean systems or rebuild them?
On critical systems where the attacker had admin rights, rebuilding is safer. Where evidence shows all changes, cleaning may be sufficient. We decide together, system by system.
Why not start the clean-up immediately?
Early or partial clean-up alerts the attacker. They may continue through an unknown route or trigger ransomware early. If active damage is ongoing, containment is done without delay.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting