// THREAT DETECTION AND DATA PRIVACY TERM
Eradication
Eradication is the phase of incident response focused on completely removing the attacker and their malicious tools from the affected systems. This involves actions like deleting malware, disabling compromised accounts, and patching the security flaws that were exploited.
TECHNICAL DEFINITION
In the cybersecurity incident response (IR) lifecycle, the Eradication phase involves the complete removal of all threat actor artifacts, such as malware and backdoors, from compromised systems and networks following containment. This step eliminates the root cause of the security incident by patching vulnerabilities and hardening configurations to prevent reinfection before the recovery phase.
BACKGROUND
Computer security is a subdiscipline within the field of information security. It focuses on protecting computer software, systems, and networks from threats that can lead to unauthorized information disclosure, theft, or damage to hardware, software, or data, as well as to the disruption or misdirection of the services they provide.
READ MORE ON WIKIPEDIASYNONYMS & ALIASES
- Threat removal
- Remediation
- Disinfection
- Cleanup phase
- Threat elimination
- Neutralization
USAGE NOTE
Eradication is performed after an incident is fully contained to prevent the threat actor from re-establishing a foothold during the cleanup process.
DEVELOPERS
Organizations developing technology related to Eradication.
A leading cybersecurity company whose Falcon platform provides cloud-native endpoint protection, including threat hunting and response capabilities. Its Endpoint Detection and Response (EDR) tools allow security teams to isolate compromised systems, terminate malicious processes, and delete persistence mechanisms, which are core activities in the eradication phase of incident response.
A premier incident response firm, Mandiant specializes in investigating and remediating complex cyber breaches. A critical part of their service is the eradication of adversaries from compromised networks, where they use proprietary technology and forensic expertise to ensure all attacker tools, accounts, and backdoors are removed.
Developer of the Singularity XDR platform, which uses AI to provide autonomous endpoint protection. Its technology is designed to not only detect threats but also to automatically respond by killing malicious processes, quarantining files, and remediating unauthorized changes, effectively eradicating threats without human intervention.
Offers the Cortex XDR platform, which provides comprehensive detection and response across endpoint, network, and cloud environments. Security analysts can use Cortex XDR to surgically terminate malware, isolate endpoints, and execute response scripts to systematically eradicate threats from the enterprise.
Through its Microsoft Defender for Endpoint solution, the company provides extensive EDR capabilities integrated into the Windows operating system. It allows security teams to take direct response actions, such as isolating machines, stopping and quarantining files, and removing malicious registry keys to fully eradicate a threat.
Formed from the merger of McAfee Enterprise and FireEye, Trellix offers a broad portfolio of security products, including an Extended Detection and Response (XDR) ecosystem. Their tools and managed services focus on helping organizations remove advanced threats and restore systems to a known good state.
A cybersecurity company specializing in Industrial Control Systems (ICS) and Operational Technology (OT) environments. The Dragos Platform and their incident response services are specifically designed to help critical infrastructure operators safely contain and eradicate threats from sensitive industrial networks where traditional IT tools are often unsuitable.
Provides a suite of cybersecurity products, including Intercept X with EDR. Their Managed Threat Response (MTR) service combines technology with human experts who actively hunt for, contain, and neutralize threats on behalf of customers, performing the hands-on eradication of complex adversaries.