APT Capstone II: Eradicate Every Foothold

Reconstruction told you what happened; eradication decides whether the attacker keeps access. A capable intruder plants MULTIPLE independent persistence mechanisms precisely so that removing one leaves the others — so the job here is completeness, not cleverness. This host carries four separate footholds, each hiding next to a legitimate look-alike: a malicious cron, a backdoor SSH key, a login init-script that phones home, and an extra root-equivalent (UID-0) account.

Hunt across the classic persistence surfaces (cron.d, authorized_keys, profile.d, /etc/passwd), tell the real footholds from the decoys, then do two things: record a complete remediation manifest as two plain-text files in /root/case/remediation/ (create the directory), and actually remove every foothold from the host.

• /root/case/remediation/persistence.txt — one item per line: the full path of the malicious /etc/cron.d file, the full path of the malicious /etc/profile.d script, and the backdoor SSH key's comment (the text after the key material, e.g. user@host).
• /root/case/remediation/accounts.txt — the backdoor UID-0 account's name.

List only the malicious items, never their legitimate look-alikes. Then eradicate: delete the malicious cron.d file and profile.d script, delete the backdoor line from authorized_keys, and delete the backdoor account from /etc/passwd. Leave the legitimate look-alikes in place: deleting the admin's key or the real cron job is an outage, not a cleanup. Miss even one and the box is still owned. Grading checks the manifest against the full set it re-derives, and checks the host itself to confirm each foothold is gone and each look-alike survived. Everything is inert. MITRE ATT&CK: T1053.003, T1098.004, T1546, T1136 / T1078.