Anthropic-Cybersecurity-Skills/skills/eradicating-malware-from-infected-systems/references/standards.md

# Standards and Framework References - Malware Eradication

## NIST SP 800-61 Rev. 3 - Eradication Alignment
- **Respond (RS.MI-02)**: Incidents are eradicated
- Eradication follows containment; remove all attacker artifacts
- Must address root cause, not just symptoms
- Verify eradication before moving to recovery

## NIST SP 800-83 - Guide to Malware Incident Prevention and Handling
- Section 4: Handling Malware Incidents
  - 4.3: Containment and Eradication
  - 4.3.1: Identification of infected hosts
  - 4.3.2: Containment options (quarantine, disconnect, block)
  - 4.3.3: Eradication and recovery options
- Reference: https://csrc.nist.gov/pubs/sp/800/83/r1/final

## SANS PICERL - Eradication Phase
- Phase 4 of SANS incident handling process
- Remove malware and attacker tools from all affected systems
- Identify and remediate the root cause
- Improve defenses based on attack methods used

## MITRE ATT&CK - Persistence Techniques to Eradicate

### Windows Persistence (T1547)
| Sub-technique | Location | Eradication Method |
|--------------|----------|-------------------|
| T1547.001 | Registry Run Keys | Delete malicious registry values |
| T1547.004 | Winlogon Helper DLL | Restore legitimate DLL path |
| T1547.005 | Security Support Provider | Remove from registry |
| T1547.009 | Shortcut Modification | Restore original shortcuts |

### Scheduled Task/Job (T1053)
| Sub-technique | Location | Eradication Method |
|--------------|----------|-------------------|
| T1053.005 | Scheduled Task | schtasks /delete |
| T1053.003 | Cron | Remove crontab entries |
| T1053.006 | Systemd Timers | Disable and remove timer units |

### Create/Modify System Process (T1543)
| Sub-technique | Location | Eradication Method |
|--------------|----------|-------------------|
| T1543.003 | Windows Service | sc delete ServiceName |
| T1543.002 | Systemd Service | systemctl disable + rm unit file |
| T1543.001 | Launch Agent | Remove plist file |

### Other Persistence
| Technique | Description | Eradication |
|-----------|-------------|-------------|
| T1546.003 | WMI Event Subscription | Remove filter, consumer, binding |
| T1546.015 | COM Object Hijacking | Restore CLSID registry values |
| T1098 | Account Manipulation | Remove backdoor accounts |
| T1136 | Create Account | Delete unauthorized accounts |
| T1556 | Modify Authentication | Restore authentication mechanisms |
| T1505.003 | Web Shell | Remove web shell files |

## CISA Malware Analysis Reports (MARs)
- Published IOCs and eradication guidance for specific threats
- Reference: https://www.cisa.gov/news-events/cybersecurity-advisories

## Microsoft DART Eradication Guidance
- Recommended approach for Active Directory compromise recovery
- KRBTGT password reset procedures
- Tiered administration model implementation
- Reference: Microsoft Incident Response playbooks