RB-RECOVERY-002 · Clean System Rebuild

1. Prerequisites

Compromise analysis findings (artefacts, persistence, IOCs)
System criticality / business impact context
Access to the target system's management platform (for cleanup, rebuild, and validation)
Access to EDR / security tooling on the target system

Determine Recovery Approach
- Assess compromise severity
- Assess persistence mechanisms
- Assess system criticality
- Assess confidence in cleanup capability
- Determine whether cleanup is sufficient or full rebuild / re-provisioning (recommended) is required
Execute either 2 (cleanup-in-place) or 3 (rebuild / re-provision), based on the decision made in 1. Do not execute both.
Execute Cleanup (Cleanup-In-Place Path Only)
- Remove malicious binaries
- Remove persistence mechanisms
- Remove malicious services
- Remove unauthorised configuration changes (registry, system config, IAM policies, app settings)
- Remove scheduled tasks / cron jobs / automation triggers
- Remove unauthorised accounts, API keys, tokens, or app installs
Execute Rebuild / Re-provision (Rebuild Path Only)
- Perform full system reimage, container rebuild, VM re-provisioning, or tenant reset as appropriate
- Perform operating system / platform validation
- Perform security tooling reinstallation
- Perform patch validation
Validate System Integrity
- Confirm no active compromise indicators
- Confirm no persistence remains
- Confirm EDR / security tooling operational
- Confirm security controls healthy
- Confirm system activity normal

Record the chosen recovery path (cleanup or rebuild), the rationale, and a timestamped log of all recovery actions in the incident ticket.

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.