SANS Incident Handler's Handbook and PICERL Methodology
Phase 4: Eradication – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology E-1: Remove malicious content and restore clean systems, usually by full reimaging from known-good images, documenting effort and cost

What does E-1 require?

The team removes malicious and illicit content and restores affected systems so they are thoroughly clean, which generally means reimaging the drives (for example from pre-deployment disk images) and scanning with anti-malware for latent code, while documenting all actions to measure hours and resources spent as the organization's cost of the incident.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 4: Eradication – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls