In the Eradication phase of the Threat Hunting process, what is the main goal?

The Eradication phase is a critical step within the incident response lifecycle, specifically following containment. The primary objective of this phase is to completely and permanently remove all components of the incident from the environment. This involves actions such as deleting malware, disabling breached user accounts, and eliminating any persistence mechanisms or artifacts left by the attacker. The goal is to ensure the threat is fully neutralized and cannot re-emerge from any remaining presence on the affected systems.

A. Identifying all affected systems is a primary goal of the Detection & Analysis and Containment phases, which precede Eradication.
C. Updating security policies is a part of the Post-Incident Activity (or Lessons Learned) phase, focusing on long-term improvements to prevent recurrence.
D. Reporting the threat to management is a continuous communication activity that occurs throughout the entire incident response process, not the main technical goal of this specific phase.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61, Rev. 2).

Section 3.3.3, "Eradication & Recovery," Page 31: "After an incident has been contained, eradication may be necessary to eliminate components of the incident, such as deleting malware and disabling breached user accounts, and to identify and mitigate all vulnerabilities that were exploited." This directly supports that the goal is to eliminate threat components.

2. Cisco. (2021). Cybersecurity Incident Response Plan.

Section: "Containment, Eradication, and Recovery," Page 5: This document outlines the incident response process in alignment with the NIST framework, stating that the Eradication step involves "removing the threat and restoring operations." This confirms the focus on removal.

3. Carnegie Mellon University Software Engineering Institute. (2016). Defining the Building Blocks of a Cyber Security Incident Response Team.

Section 3.2.3, "Response," Page 14: The document describes the response phase, which includes eradication. It states, "Eradication is the process of removing the cause and effects of the incident... This may include removing malicious code, deleting accounts, or other such actions." This reinforces the concept of complete removal.