Intelligence-Driven Incident Response, 2nd Edition

Chapter 6. Finish

It’s not so important who starts the game but who finishes it.

John Wooden

Once you have identified the threats that you are facing and investigated how those threats have accessed and moved through your network, it is time to remove them. This phase is known as Finish and involves not only eradicating the footholds that malicious actors have put in your network, but also working to remediate whatever enabled them to get access in the first place.

Finish involves more than removing malware from a system, which is why we spend so much time in the Find and Fix stages. To properly finish an attacker’s activity, it is critical to understand how that threat actor operates and to remove not just malware or artifacts left behind by an attack, but also communications channels, footholds, redundant access, and any other aspects of an attack that we uncovered in the Fix phase. Properly finishing an adversary requires a deep understanding of the attacker, their motives, and their actions, which will allow you to act with confidence as you secure the systems and regain control of your network.

Finishing Is Not Hacking Back

Finish does not mean hacking back. That is because, unless you are a government department or agency with the proper authority, hacking back—as we discussed earlier—is a very, very bad idea! Why, you ask? There are several reasons:

Attribution is rarely perfect.

You don’t always know what you will end up hacking. Attackers will rarely attack you directly ...