What does eradication mean in incident response?
Eradication is removing the attacker's presence completely before you bring systems back. It includes deleting malware and tools, closing the way in, removing accounts, scheduled tasks and remote-access software the attacker created, resetting every credential that may have been exposed, and patching the vulnerabilities they used. In practice, rebuilding affected machines from clean images is often more reliable than cleaning them, because it is hard to prove that every change has been found. Eradication fails when it is partial: attackers who keep one foothold come back, sometimes weeks later. It should be planned from the evidence of your investigation, not guessed. Watching the network afterwards tests whether it worked: NetSenX flags renewed beaconing to known or new outside servers and new lateral sessions, on every plan.