skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

eradicating-malware-from-infected-systems

Removes malware, persistence mechanisms, and compromised credentials from infected Windows and Linux systems.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#credential rotation#yara#eradication#DFIR#persistence mechanisms#malware removal
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill eradicating-malware-from-infected-systems
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: eradicating-malware-from-infected-systems
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/eradicating-malware-from-infected-systems
Command: npx skills add https://github.com/xalgord/xalgorix --skill eradicating-malware-from-infected-systems

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

After containing a malware infection, responders often miss hidden persistence mechanisms or compromised credentials, causing reinfection within hours. This Skill provides a systematic eradication workflow that removes every attacker artifact and validates the cleanup before recovery.

Core Features & Use Cases

  • Persistence Sweeping: Enumerates and removes all autostart mechanisms including registry Run keys, scheduled tasks, WMI event subscriptions, services, cron jobs, and SSH authorized_keys.
  • Credential Rotation: Resets compromised accounts, double-resets krbtgt to invalidate Golden Tickets, and revokes cloud refresh tokens.
  • Eradication Validation: Re-runs Autoruns, YARA scans, and network connection checks to confirm zero remaining artifacts before lifting isolation.
  • Use Case: After confirming a RAT infection across multiple endpoints, follow the six-step workflow to map persistence, remove artifacts fleet-wide, rotate credentials, patch the entry vector, and validate eradication with YARA and EDR scans.

Quick Start

Use this skill to eradicate the confirmed malware infection from our compromised Windows servers and validate that no persistence mechanisms remain.

Frequently Asked Questions about eradicating-malware-from-infected-systems

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I remove malware persistence from a Windows system?▼

Enumerate all autostart locations with Autoruns, then check registry Run keys, scheduled tasks via schtasks, WMI event subscriptions, and services. Remove each malicious entry individually, since killing the process and deleting the binary leaves the relaunch mechanism intact.

How to eradicate malware across multiple infected hosts?▼

Hunt the IOC or YARA signature across the entire estate before cleaning any single host, since the same implant usually lives on multiple machines. Eradicate fleet-wide while network isolation remains in effect to prevent reinfection from unscoped peers.

Why does malware come back after removal?▼

Reinfection usually results from missed persistence mechanisms like WMI subscriptions or COM hijacks that Autoruns alone does not catch. Other causes include unrotated credentials, a single krbtgt reset leaving Golden Tickets valid, or an unpatched initial-access vulnerability.

When should I re-image instead of cleaning an infected system?▼

Re-image from known-good media when dealing with rootkits, bootkits, or any uncertainty about cleanup completeness. Kernel-level malware can survive standard removal steps, making a trusted rebuild safer than relying on clean scan results.

How do I verify malware eradication was successful?▼

Re-run Autoruns and confirm zero unknown or unsigned entries, re-run YARA across the host with zero hits, and check for established connections to non-internal IPs. Also verify the EDR agent is healthy and reporting before lifting isolation.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
spigellspigell

k8s-backup

Automate Kubernetes backup and restore workflows using Velero.

Community
Intermediate
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-bootkit-and-rootkit-samples

Detect bootkit and rootkit infections via MBR/VBR and UEFI implant analysis.

Community
Advanced