## Phase 4: Eradication & Recovery - Clean Up

### Eradication
The threat is contained. Now remove it.
1.  **Re-imaging**: The old way was "run Antivirus and hope it cleans it." The Modern way is **Nuke and Pave**.
    *   Wipe the drive.
    *   Re-install OS from a verified clean "Golden Image".
2.  **Sanitization**:
    *   Remove malicious emails from users' inboxes.
    *   Reset passwords (force global reset if Active Directory was compromised).
3.  **Improve Defenses**:
    *   The attacker got in via RDP? Disable RDP.
    *   They used a vulnerability? Patch it.

### Recovery
Bringing systems back online.
1.  **Prioritization**: Restore business-critical systems first (ERP, Email) > secondary systems.
2.  **Validation**: Before reconnecting to the internet, **monitor** the restored system. Is it beaconing again? (Attackers often hide "persistence" triggers).
3.  **Data Restoration**: Restore data from clean backups.
    *   *Risk*: What if the backup also contains the malware? You must scan backups before restoring.

### The "Screaming Test"
Sometimes, you disable a compromised account and wait to see who screams (which service breaks). This helps identify hidden dependencies.