What it does. Systematically map and remove malware, backdoors, and attacker persistence Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/eradicating-malware-from-infected-systems/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill eradicating-malware-from-infected-systems, or copy the skill folder into ~/.claude/skills/eradicating-malware-from-infected-systems/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/eradicating-malware-from-infected-systems/SKILL.md

SKILL.md (verbatim)

name: eradicating-malware-from-infected-systems
description: Systematically map and remove malware, backdoors, and attacker persistence
  mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d)
  from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a
  clean state while preventing re-infection. Use after containment and forensic analysis
  have identified all compromised systems and persistence mechanisms and you are ready to
  eradicate and recover.
domain: cybersecurity
subdomain: incident-response
tags:
- incident-response
- eradication
- malware-removal
- persistence
- dfir
mitre_attack:
- T1486
- T1490
- T1070
- T1078
- T1547
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01

Eradicating Malware from Infected Systems

When to Use

• Malware infection confirmed and containment is in place
• Forensic investigation has identified all persistence mechanisms
• All compromised systems have been identified and scoped
• Ready to remove attacker artifacts and restore clean state
• Post-containment phase requires systematic cleanup

Prerequisites

• Completed forensic analysis identifying all malware artifacts
• List of all compromised systems and accounts
• EDR/AV with updated signatures deployed
• YARA rules for the specific malware family
• Clean system images or verified backups for restoration
• Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

# Windows - Check all known persistence locations
# Autoruns (Sysinternals) - comprehensive autostart enumeration
autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv

# Registry Run keys
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s

# Scheduled tasks
schtasks /query /fo CSV /v > schtasks_all.csv

# WMI event subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

# Services
Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName

# Linux persistence
cat /etc/crontab
ls -la /etc/cron.*/
ls -la /etc/init.d/
systemctl list-unit-files --type=service | grep enabled
cat /etc/rc.local
ls -la ~/.bashrc ~/.profile ~/.bash_profile

Step 2: Identify All Malware Artifacts

# Scan with YARA rules specific to the malware family
yara -r -s malware_rules/specific_family.yar C:\ 2>/dev/null

# Scan with multiple AV engines
# ClamAV scan
clamscan -r --infected --remove=no /mnt/infected_disk/

# Check for known malicious file hashes
find / -type f -newer /tmp/baseline_timestamp -exec sha256sum {} \; 2>/dev/null | \
  while read hash file; do
    grep -q "$hash" known_malicious_hashes.txt && echo "MALICIOUS: $file ($hash)"
  done

# Check for web shells
find /var/www/ -name "*.php" -newer /tmp/baseline -exec grep -l "eval\|base64_decode\|system\|passthru\|shell_exec" {} \;

# Check for unauthorized SSH keys
find / -name "authorized_keys" -exec cat {} \; 2>/dev/null

Step 3: Remove Malware Files and Artifacts

# Remove identified malicious files (after forensic imaging)
# Windows
Remove-Item -Path "C:\Windows\Temp\malware.exe" -Force
Remove-Item -Path "C:\Users\Public\backdoor.dll" -Force

# Remove malicious scheduled tasks
schtasks /delete /tn "MaliciousTaskName" /f

# Remove WMI persistence
Get-WMIObject -Namespace root\Subscription -Class __EventFilter -Filter "Name='MalFilter'" | Remove-WMIObject
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer -Filter "Name='MalConsumer'" | Remove-WMIObject

# Remove malicious registry entries
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MalEntry" /f

# Remove malicious services
sc stop "MalService" && sc delete "MalService"

# Linux - Remove malicious cron entries, binaries, SSH keys
crontab -r  # Remove entire crontab (or edit specific entries)
rm -f /tmp/.hidden_backdoor
sed -i '/malicious_key/d' ~/.ssh/authorized_keys
systemctl disable malicious-service && rm /etc/systemd/system/malicious-service.service

Step 4: Reset Compromised Credentials

# Reset all compromised user passwords
Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "OU=CompromisedUsers,DC=domain,DC=com" |
  Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString "TempP@ss!$(Get-Random)" -AsPlainText -Force)

# Reset KRBTGT password (twice, 12+ hours apart for Kerberos golden ticket attack)
Reset-KrbtgtPassword -DomainController DC01
# Wait 12+ hours, then reset again
Reset-KrbtgtPassword -DomainController DC01

# Rotate service account passwords
Get-ADServiceAccount -Filter * | ForEach-Object {
  Reset-ADServiceAccountPassword -Identity $_.Name
}

# Revoke all Azure AD tokens
Get-AzureADUser -All $true | ForEach-Object {
  Revoke-AzureADUserAllRefreshToken -ObjectId $_.ObjectId
}

# Rotate API keys and secrets
# Application-specific credential rotation

Step 5: Patch Vulnerability Used for Initial Access

# Identify and patch the entry point vulnerability
# Windows Update
Install-WindowsUpdate -KBArticleID "KB5001234" -AcceptAll -AutoReboot

# Linux patching
apt update && apt upgrade -y  # Debian/Ubuntu
yum update -y                 # RHEL/CentOS

# Application-specific patches
# Update web application frameworks, CMS, etc.

# Verify patch was applied
Get-HotFix -Id "KB5001234"

Step 6: Validate Eradication

# Full system scan with updated signatures
# CrowdStrike Falcon - On-demand scan
curl -X POST "https://api.crowdstrike.com/scanner/entities/scans/v1" \
  -H "Authorization: Bearer $FALCON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["device_id"]}'

# Verify no persistence mechanisms remain
autorunsc.exe -accepteula -a * -c -h -s -v | findstr /i "unknown verified"

# Check for any remaining suspicious processes
Get-Process | Where-Object {$_.Path -notlike "C:\Windows\*" -and $_.Path -notlike "C:\Program Files*"}

# Verify no unauthorized network connections
Get-NetTCPConnection -State Established |
  Where-Object {$_.RemoteAddress -notlike "10.*" -and $_.RemoteAddress -notlike "172.16.*"} |
  Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess

# Run YARA rules again to confirm no artifacts remain
yara -r malware_rules/specific_family.yar C:\ 2>/dev/null

Key Concepts

Concept	Description
Persistence Mechanism	Method attacker uses to maintain access across reboots
Root Cause Remediation	Fixing the vulnerability that enabled initial compromise
Credential Rotation	Resetting all potentially compromised passwords and tokens
KRBTGT Reset	Invalidating Kerberos tickets after golden ticket attack
Indicator Sweep	Scanning all systems for known malicious artifacts
Validation Scan	Confirming eradication was successful before recovery
Re-imaging	Rebuilding systems from clean images rather than cleaning

Tools & Systems

Tool	Purpose
Sysinternals Autoruns	Enumerate all Windows autostart locations
YARA	Custom rule-based malware scanning
CrowdStrike/SentinelOne	EDR-based scanning and remediation
ClamAV	Open-source antivirus scanning
PowerShell	Scripted cleanup and validation
Velociraptor	Remote artifact collection and remediation

Common Scenarios

1. RAT with Multiple Persistence: Remote access trojan using registry, scheduled task, and WMI subscription. Must remove all three persistence mechanisms.
2. Web Shell on IIS/Apache: PHP/ASPX web shell in web root. Remove shell, audit all web files, patch application vulnerability.
3. Rootkit Infection: Kernel-level rootkit that survives cleanup. Requires full re-image from known-good media.
4. Fileless Malware: PowerShell-based attack living in memory and registry. Remove registry entries, clear WMI subscriptions, restart system.
5. Active Directory Compromise: Attacker created backdoor accounts and golden tickets. Reset KRBTGT, remove rogue accounts, audit group memberships.

Output Format

• Eradication action log with all removed artifacts
• Credential rotation confirmation report
• Vulnerability patching verification
• Post-eradication validation scan results
• Systems cleared for recovery phase

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Malware Eradication Report

Incident Information

Field	Value
Incident ID
Malware Family
Eradication Date	YYYY-MM-DD
Eradication Lead
Systems Affected	[count]

Artifacts Removed

Malware Files

System	File Path	SHA256	Removal Status
			Removed/Failed

Persistence Mechanisms Removed

System	Type	Location	Details	Status
	Registry
	Scheduled Task
	Service
	WMI Subscription
	Cron Job

Accounts Remediated

Account	Type	Action	Status
	User/Service/Admin	Disabled/Reset/Deleted

Credential Rotation

• KRBTGT password reset (first reset)
• KRBTGT password reset (second reset, 12+ hours later)
• Domain admin passwords rotated
• Service account passwords rotated
• Compromised user passwords reset
• API keys/tokens revoked and reissued
• SSL/TLS certificates rotated (if compromised)

Root Cause Remediation

Vulnerability	CVE	Patch/Fix Applied	Verified
			Yes/No

Validation Results

• Full EDR scan clean on all systems
• YARA scan clean on all systems
• No suspicious autostart entries remain
• No unauthorized processes running
• No unauthorized network connections
• All patches verified applied
• Credential rotation confirmed

Systems Cleared for Recovery

System	Eradication Method	Validation Status	Cleared By
	Clean/Re-image	Pass/Fail

Approvals

Role	Name	Date
Incident Commander
Forensic Analyst

references/api-reference.md (verbatim)

API Reference: Malware Eradication

Windows Process Termination

taskkill

taskkill /F /PID 1234           # Kill by PID
taskkill /F /IM malware.exe     # Kill by name
taskkill /F /T /PID 1234       # Kill process tree

PowerShell

Stop-Process -Id 1234 -Force
Get-Process -Name "malware" | Stop-Process -Force

Windows Persistence Cleanup

Registry Run Keys

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v MalwareName /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v MalwareName /f

Scheduled Tasks

schtasks /Delete /TN "MalwareTask" /F
schtasks /Query /FO CSV /V /NH

Services

sc stop MalwareService
sc delete MalwareService
sc query type= all state= all

Linux Persistence Cleanup

Crontab

crontab -l -u root         # List root cron
crontab -r -u root         # Remove all cron (use carefully)
ls -la /etc/cron.d/
ls -la /var/spool/cron/

Systemd Services

systemctl list-unit-files --type=service
systemctl disable malware.service
systemctl stop malware.service
rm /etc/systemd/system/malware.service
systemctl daemon-reload

Process Kill

kill -9 <pid>
pkill -f "malware_pattern"

File Quarantine Best Practices

Hash Before Move

sha256sum /path/to/malware > /quarantine/hash.txt

Secure Move

mv /path/to/malware /quarantine/sha256_filename.quarantine
chmod 000 /quarantine/sha256_filename.quarantine

Autoruns (Sysinternals)

Command Line

autorunsc.exe -a * -c -h -s -v -vt

Output Columns

Column	Description
Entry	Autorun name
Image Path	Binary location
Signer	Code signing info
VT Detection	VirusTotal results

YARA Scanning for Remaining Artifacts

Command

yara -r rules.yar /target/directory

Rule Example

rule Malware_Remnant {
    strings:
        $s1 = "malware_mutex" ascii
        $s2 = {4D 5A 90 00}
    condition:
        any of them
}

references/standards.md (verbatim)

Standards and Framework References - Malware Eradication

NIST SP 800-61 Rev. 3 - Eradication Alignment

• Respond (RS.MI-02): Incidents are eradicated
• Eradication follows containment; remove all attacker artifacts
• Must address root cause, not just symptoms
• Verify eradication before moving to recovery

NIST SP 800-83 - Guide to Malware Incident Prevention and Handling

• Section 4: Handling Malware Incidents
  • 4.3: Containment and Eradication
  • 4.3.1: Identification of infected hosts
  • 4.3.2: Containment options (quarantine, disconnect, block)
  • 4.3.3: Eradication and recovery options
• Reference: https://csrc.nist.gov/pubs/sp/800/83/r1/final

SANS PICERL - Eradication Phase

• Phase 4 of SANS incident handling process
• Remove malware and attacker tools from all affected systems
• Identify and remediate the root cause
• Improve defenses based on attack methods used

MITRE ATT&CK - Persistence Techniques to Eradicate

Windows Persistence (T1547)

Sub-technique	Location	Eradication Method
T1547.001	Registry Run Keys	Delete malicious registry values
T1547.004	Winlogon Helper DLL	Restore legitimate DLL path
T1547.005	Security Support Provider	Remove from registry
T1547.009	Shortcut Modification	Restore original shortcuts

Scheduled Task/Job (T1053)

Sub-technique	Location	Eradication Method
T1053.005	Scheduled Task	schtasks /delete
T1053.003	Cron	Remove crontab entries
T1053.006	Systemd Timers	Disable and remove timer units

Create/Modify System Process (T1543)

Sub-technique	Location	Eradication Method
T1543.003	Windows Service	sc delete ServiceName
T1543.002	Systemd Service	systemctl disable + rm unit file
T1543.001	Launch Agent	Remove plist file

Other Persistence

Technique	Description	Eradication
T1546.003	WMI Event Subscription	Remove filter, consumer, binding
T1546.015	COM Object Hijacking	Restore CLSID registry values
T1098	Account Manipulation	Remove backdoor accounts
T1136	Create Account	Delete unauthorized accounts
T1556	Modify Authentication	Restore authentication mechanisms
T1505.003	Web Shell	Remove web shell files

CISA Malware Analysis Reports (MARs)

• Published IOCs and eradication guidance for specific threats
• Reference: https://www.cisa.gov/news-events/cybersecurity-advisories

Microsoft DART Eradication Guidance

• Recommended approach for Active Directory compromise recovery
• KRBTGT password reset procedures
• Tiered administration model implementation
• Reference: Microsoft Incident Response playbooks

references/workflows.md (verbatim)

Malware Eradication - Detailed Workflow

Pre-Eradication Checklist

• Forensic images collected from all compromised systems
• All IOCs identified and documented
• All persistence mechanisms mapped
• Root cause (initial access vector) identified
• Containment verified and holding
• Eradication plan approved by Incident Commander
• Rollback plan prepared in case eradication fails

Eradication Phases

Phase 1: Artifact Inventory

1. Compile list of all malware files with paths and hashes
2. Map all persistence mechanisms per system
3. List all compromised accounts (user, service, admin)
4. Identify all backdoor access methods
5. Document network-level indicators (C2 IPs, domains)
6. Note any configuration changes made by attacker

Phase 2: Coordinated Removal

Execute removal across ALL compromised systems simultaneously to prevent attacker from detecting cleanup on one system and acting on another.

Simultaneous Actions:

1. Remove malware files from all systems
2. Delete persistence mechanisms (registry, tasks, services, WMI)
3. Disable compromised accounts
4. Block all C2 infrastructure at network level
5. Remove unauthorized SSH keys and certificates
6. Clean up web shells from all web servers

Phase 3: Credential Reset

Priority Order:

1. KRBTGT password (reset twice, 12+ hours apart)
2. Domain admin accounts
3. Service accounts
4. All accounts that logged into compromised systems
5. Application credentials and API keys
6. Machine account passwords (if targeted)

Phase 4: Vulnerability Remediation

1. Patch the vulnerability used for initial access
2. Patch any additional vulnerabilities discovered during investigation
3. Harden configurations that were exploited
4. Update security tool signatures and rules
5. Close unnecessary ports and services

Phase 5: Validation

1. Full AV/EDR scan on all previously compromised systems
2. YARA scan for specific malware family artifacts
3. Check all persistence locations are clean
4. Verify no unauthorized processes running
5. Confirm no unauthorized network connections
6. Validate all credentials were successfully rotated
7. Test that patches are properly applied

Decision: Clean vs. Re-Image

When to Clean (In-Place Remediation)

• Limited number of artifacts
• Well-understood malware family
• No rootkit or bootkit components
• Time pressure requires faster recovery
• System configuration is complex to rebuild

When to Re-Image (Full Rebuild)

• Rootkit or bootkit detected
• Kernel-level compromise
• Domain controller compromise
• Inability to confirm complete eradication
• Simpler to rebuild than to clean
• Legal requirements demand clean systems

Common Persistence Locations Reference

Windows

Registry:
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (Shell, Userinit)
  HKLM\SYSTEM\CurrentControlSet\Services
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Filesystem:
  %AppData%\Microsoft\Windows\Start Menu\Programs\Startup
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  C:\Windows\System32\Tasks\
  C:\Windows\System32\drivers\

WMI:
  root\Subscription\__EventFilter
  root\Subscription\CommandLineEventConsumer
  root\Subscription\__FilterToConsumerBinding

Linux

Cron:
  /etc/crontab
  /etc/cron.d/*
  /etc/cron.daily/*
  /var/spool/cron/crontabs/*

Services:
  /etc/systemd/system/*.service
  /etc/init.d/*
  /etc/rc.local

Shell:
  ~/.bashrc, ~/.profile, ~/.bash_profile
  /etc/profile.d/*
  /etc/environment

SSH:
  ~/.ssh/authorized_keys
  /etc/ssh/sshd_config

Other:
  /etc/ld.so.preload
  Kernel modules: /lib/modules/

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.