<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: eradicating-malware
description: >-
  Systematically removes malware, persistence mechanisms, backdoors, and attacker
  artifacts from compromised systems to restore a clean operational state.
domain: cybersecurity
subdomain: incident-response
tags:
  - malware-eradication
  - persistence-removal
  - rootkit-removal
  - YARA
  - IOC-scanning
  - system-restoration
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1587.001"]
---

# Eradicating Malware

## Overview

Eradication removes all attacker footholds — malware binaries, persistence
mechanisms, backdoor accounts, modified configurations, and implanted tools.
Incomplete eradication leads to re-compromise. The process requires systematic
scanning, persistence catalog review, and verification that every identified
mechanism is neutralized before systems return to production.

Eradicate only AFTER containment is confirmed and evidence is preserved.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| YARA | Pattern-based malware scanning | `pip install yara-python` |
| LOKI | IOC and YARA scanner | GitHub release |
| Thor Lite | Compromise assessment | Nextron Systems |
| ClamAV | Open-source AV scanning | `apt install clamav` |
| Autoruns | Persistence enumeration (Windows) | Sysinternals |
| chkrootkit | Linux rootkit detection | `apt install chkrootkit` |
| rkhunter | Linux rootkit hunter | `apt install rkhunter` |

## Key Concepts

### Persistence Mechanisms to Check

#### Windows
| Mechanism | Location | Tool |
|-----------|----------|------|
| Registry Run keys | HKLM/HKCU\...\Run | RECmd, Autoruns |
| Scheduled Tasks | C:\Windows\System32\Tasks | schtasks, Autoruns |
| Services | HKLM\SYSTEM\...\Services | sc.exe, Autoruns |
| WMI Subscriptions | WMI repository | Get-WMIObject |
| DLL Side-loading | Application directories | Autoruns |
| Startup folder | Shell:startup | dir |
| COM Objects | HKLM\SOFTWARE\Classes\CLSID | Autoruns |
| Boot/UEFI | EFI system partition | Autoruns |

#### Linux
| Mechanism | Location |
|-----------|----------|
| Crontabs | /etc/crontab, /var/spool/cron/ |
| Systemd services | /etc/systemd/system/, ~/.config/systemd/ |
| Init scripts | /etc/init.d/, /etc/rc.local |
| Shell profiles | .bashrc, .profile, /etc/profile.d/ |
| SSH authorized_keys | ~/.ssh/authorized_keys |
| LD_PRELOAD | /etc/ld.so.preload |
| Kernel modules | /lib/modules/, lsmod |
| PAM modules | /etc/pam.d/ |

### YARA Rule Structure

```yara
rule Suspicious_PowerShell_Encoded {
    meta:
        description = "Detects Base64 encoded PowerShell commands"
        author = "defconxt"
        severity = "high"
    strings:
        $enc1 = "powershell" ascii nocase
        $enc2 = "-enc" ascii nocase
        $enc3 = "-EncodedCommand" ascii nocase
        $b64 = /[A-Za-z0-9+\/]{50,}={0,2}/ ascii
    condition:
        ($enc1 and ($enc2 or $enc3)) and $b64
}
```

## Workflow

### Step 1 — Enumerate All Persistence

```bash
# Linux — check all persistence locations
echo "=== Crontabs ===" && crontab -l 2>/dev/null && ls -la /etc/cron*
echo "=== Systemd services ===" && systemctl list-unit-files --type=service | grep enabled
echo "=== Init scripts ===" && ls -la /etc/init.d/ /etc/rc.local 2>/dev/null
echo "=== SSH keys ===" && find /home -name authorized_keys -exec cat {} \;
echo "=== Shell profiles ===" && grep -r "curl\|wget\|python\|nc\|bash -i" /etc/profile.d/ ~/.bashrc 2>/dev/null
echo "=== LD_PRELOAD ===" && cat /etc/ld.so.preload 2>/dev/null
echo "=== Loaded modules ===" && lsmod | grep -v "^Module"
```

```powershell
# Windows — Autoruns equivalent
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>$null
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" 2>$null
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} | Select-Object TaskName, TaskPath, State
Get-WmiObject -Namespace root\subscription -Class __EventConsumer
Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object Name, DisplayName, BinaryPathName
```

### Step 2 — IOC Scanning

```bash
# YARA scan filesystem
yara -r /rules/malware_rules.yar /opt/ /tmp/ /var/tmp/ /dev/shm/

# LOKI scanner
python3 loki.py -p /evidence/mounted_disk/ --noindicator --csv -l /evidence/loki-results.csv

# ClamAV full scan
clamscan -r --infected --log=/evidence/clamscan.log /

# Linux rootkit check
chkrootkit | tee /evidence/chkrootkit.log
rkhunter --check --skip-keypress --report-warnings-only | tee /evidence/rkhunter.log
```

### Step 3 — Remove Malware and Persistence

```bash
# Remove identified malicious files
rm -f /tmp/.hidden_backdoor
rm -f /var/tmp/cryptominer

# Remove malicious crontabs
crontab -r -u compromised_user

# Disable and remove malicious systemd service
systemctl stop malicious.service
systemctl disable malicious.service
rm /etc/systemd/system/malicious.service
systemctl daemon-reload

# Remove unauthorized SSH keys
sed -i '/attacker_key_fingerprint/d' /home/user/.ssh/authorized_keys

# Remove backdoor user accounts
userdel -r backdoor_account
```

```powershell
# Windows — remove persistence
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "MaliciousEntry"
Unregister-ScheduledTask -TaskName "MaliciousTask" -Confirm:$false
Stop-Service -Name "MaliciousService" -Force
sc.exe delete "MaliciousService"
```

### Step 4 — Credential Rotation

```bash
# Change all passwords for affected accounts
passwd compromised_user

# Rotate service account credentials
# Rotate API keys and tokens
# Reset krbtgt (AD environments — twice, 12h apart)
```

### Step 5 — Verification Scan

```bash
# Re-scan after eradication
yara -r /rules/malware_rules.yar /
chkrootkit
rkhunter --check

# Verify persistence is removed
systemctl list-unit-files --type=service | grep enabled
crontab -l
cat /etc/ld.so.preload 2>/dev/null
```

## Detection

```yaml
title: Eradicating Malware Detection
id: 3b6ad27f-fc7e-46c1-a912-c873ebb872d3
status: experimental
description: Detects suspicious activity related to eradicating malware techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*eradicating*malware*"
  condition: selection
level: high
tags:
  - attack.t1587.001
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] All identified persistence mechanisms removed
- [ ] Malware binaries deleted and verified absent
- [ ] Backdoor accounts removed
- [ ] Unauthorized SSH keys purged
- [ ] YARA/LOKI re-scan returns clean
- [ ] Rootkit checks pass (chkrootkit, rkhunter)
- [ ] Compromised credentials rotated
- [ ] System integrity baseline updated

## References

- YARA Documentation: https://yara.readthedocs.io
- LOKI Scanner: https://github.com/Neo23x0/Loki
- Autoruns: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
- MITRE ATT&CK Persistence: https://attack.mitre.org/tactics/TA0003
