erdc-malw-infe-syst

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

Zur Installation springen

Repository: Undermybelt/hermes-skills
Letzte Quellaktivität: 7. Juni 2026 um 07:23
Erkannte Sprache von SKILL.md: Englisch
Sterne: 6
Forks: 1

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/Undermybelt/hermes-skills --skill erdc-malw-infe-syst

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

8 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

Eradicating Malware from Infected Systems

When to Use

Malware infection confirmed and containment is in place

Forensic investigation has identified all persistence mechanisms

All compromised systems have been identified and scoped

Ready to remove attacker artifacts and restore clean state

Post-containment phase requires systematic cleanup

Prerequisites

Completed forensic analysis identifying all malware artifacts

List of all compromised systems and accounts

EDR/AV with updated signatures deployed

YARA rules for the specific malware family

Clean system images or verified backups for restoration

Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

# Windows - Check all known persistence locations # Autoruns (Sysinternals) - comprehensive autostart enumeration autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv # Registry Run keys reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s # Scheduled tasks schtasks /query /fo CSV /v > schtasks_all.csv # WMI event subscriptions Get-WMIObject -Namespace root\Subscription -Class __EventFilter Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding # Services Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName # Linux persistence cat /etc/crontab ls -la /etc/cron.*/ ls -la /etc/init.d/ systemctl list-unit-files --type=service | grep enabled cat /etc/rc.local ls -la ~/.bashrc ~/.profile ~/.bash_profile

Step 2: Identify All Malware Artifacts

Eradicating Malware from Infected Systems

When to Use

Malware infection confirmed and containment is in place

Forensic investigation has identified all persistence mechanisms

All compromised systems have been identified and scoped

Ready to remove attacker artifacts and restore clean state

Post-containment phase requires systematic cleanup

Prerequisites

Completed forensic analysis identifying all malware artifacts

List of all compromised systems and accounts

EDR/AV with updated signatures deployed

YARA rules for the specific malware family

Clean system images or verified backups for restoration

Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

name	erdc-malw-infe-syst
description	Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
domain	cybersecurity
subdomain	incident-response
tags	["incident-response","eradication","malware-removal","persistence","dfir"]
mitre_attack	["T1547","T1053","T1543","T1574"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

name	erdc-malw-infe-syst
description	Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
domain	cybersecurity
subdomain	incident-response
tags	["incident-response","eradication","malware-removal","persistence","dfir"]
mitre_attack	["T1547","T1053","T1543","T1574"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Concept	Description
Persistence Mechanism	Method attacker uses to maintain access across reboots
Root Cause Remediation	Fixing the vulnerability that enabled initial compromise
Credential Rotation	Resetting all potentially compromised passwords and tokens
KRBTGT Reset	Invalidating Kerberos tickets after golden ticket attack
Indicator Sweep	Scanning all systems for known malicious artifacts
Validation Scan	Confirming eradication was successful before recovery
Re-imaging	Rebuilding systems from clean images rather than cleaning

Tool	Purpose
Sysinternals Autoruns	Enumerate all Windows autostart locations
YARA	Custom rule-based malware scanning
CrowdStrike/SentinelOne	EDR-based scanning and remediation
ClamAV	Open-source antivirus scanning
PowerShell	Scripted cleanup and validation
Velociraptor	Remote artifact collection and remediation

erdc-malw-infe-syst

Installationsoptionen

Quelldateien prüfen

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Step 3: Remove Malware Files and Artifacts

Step 4: Reset Compromised Credentials

Step 5: Patch Vulnerability Used for Initial Access

Step 6: Validate Eradication

Key Concepts

Tools & Systems

Common Scenarios

Output Format

erdc-malw-infe-syst

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Mehr aus diesem Repository

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Step 3: Remove Malware Files and Artifacts

Step 4: Reset Compromised Credentials

Step 5: Patch Vulnerability Used for Initial Access

Step 6: Validate Eradication

Key Concepts

Tools & Systems

Common Scenarios

Output Format