erdc-malw-infe-syst

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

Ir a la instalación

Repositorio: Undermybelt/hermes-skills
Última actividad en el origen: 7 de junio de 2026 a las 07:23
Idioma detectado de SKILL.md: inglés
Estrellas: 6
Forks: 1

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Undermybelt/hermes-skills --skill erdc-malw-infe-syst

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

8 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

Ver todos los de este repositorio

Eradicating Malware from Infected Systems

When to Use

Malware infection confirmed and containment is in place

Forensic investigation has identified all persistence mechanisms

All compromised systems have been identified and scoped

Ready to remove attacker artifacts and restore clean state

Post-containment phase requires systematic cleanup

Prerequisites

Completed forensic analysis identifying all malware artifacts

List of all compromised systems and accounts

EDR/AV with updated signatures deployed

YARA rules for the specific malware family

Clean system images or verified backups for restoration

Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

# Windows - Check all known persistence locations # Autoruns (Sysinternals) - comprehensive autostart enumeration autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv # Registry Run keys reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s # Scheduled tasks schtasks /query /fo CSV /v > schtasks_all.csv # WMI event subscriptions Get-WMIObject -Namespace root\Subscription -Class __EventFilter Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding # Services Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName # Linux persistence cat /etc/crontab ls -la /etc/cron.*/ ls -la /etc/init.d/ systemctl list-unit-files --type=service | grep enabled cat /etc/rc.local ls -la ~/.bashrc ~/.profile ~/.bash_profile

Step 2: Identify All Malware Artifacts

Eradicating Malware from Infected Systems

When to Use

Malware infection confirmed and containment is in place

Forensic investigation has identified all persistence mechanisms

All compromised systems have been identified and scoped

Ready to remove attacker artifacts and restore clean state

Post-containment phase requires systematic cleanup

Prerequisites

Completed forensic analysis identifying all malware artifacts

List of all compromised systems and accounts

EDR/AV with updated signatures deployed

YARA rules for the specific malware family

Clean system images or verified backups for restoration

Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

name	erdc-malw-infe-syst
description	Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
domain	cybersecurity
subdomain	incident-response
tags	["incident-response","eradication","malware-removal","persistence","dfir"]
mitre_attack	["T1547","T1053","T1543","T1574"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

name	erdc-malw-infe-syst
description	Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
domain	cybersecurity
subdomain	incident-response
tags	["incident-response","eradication","malware-removal","persistence","dfir"]
mitre_attack	["T1547","T1053","T1543","T1574"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Concept	Description
Persistence Mechanism	Method attacker uses to maintain access across reboots
Root Cause Remediation	Fixing the vulnerability that enabled initial compromise
Credential Rotation	Resetting all potentially compromised passwords and tokens
KRBTGT Reset	Invalidating Kerberos tickets after golden ticket attack
Indicator Sweep	Scanning all systems for known malicious artifacts
Validation Scan	Confirming eradication was successful before recovery
Re-imaging	Rebuilding systems from clean images rather than cleaning

Tool	Purpose
Sysinternals Autoruns	Enumerate all Windows autostart locations
YARA	Custom rule-based malware scanning
CrowdStrike/SentinelOne	EDR-based scanning and remediation
ClamAV	Open-source antivirus scanning
PowerShell	Scripted cleanup and validation
Velociraptor	Remote artifact collection and remediation

erdc-malw-infe-syst

Opciones de instalación

Revisa los archivos de origen

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Step 3: Remove Malware Files and Artifacts

Step 4: Reset Compromised Credentials

Step 5: Patch Vulnerability Used for Initial Access

Step 6: Validate Eradication

Key Concepts

Tools & Systems

Common Scenarios

Output Format

erdc-malw-infe-syst

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Step 3: Remove Malware Files and Artifacts

Step 4: Reset Compromised Credentials

Step 5: Patch Vulnerability Used for Initial Access

Step 6: Validate Eradication

Key Concepts

Tools & Systems

Common Scenarios

Output Format