eradicating-malware-from-infected-systems

从受感染系统中根除恶意软件

何时使用

• 已确认恶意软件感染且遏制措施已到位
• 取证调查已识别所有持久化机制
• 所有受感染系统均已识别并确定范围
• 已准备好移除攻击者痕迹并恢复干净状态
• 遏制后阶段需要系统性清理

前提条件

• 已完成取证分析，识别所有恶意软件痕迹
• 所有受感染系统和账户的清单
• 已部署具有更新特征库的 EDR/AV
• 针对特定恶意软件家族的 YARA 规则
• 用于恢复的干净系统镜像或经过验证的备份
• 根除期间网络隔离仍然有效

工作流

步骤 1：梳理所有持久化机制

# Windows - Check all known persistence locations
# Autoruns (Sysinternals) - comprehensive autostart enumeration
autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv

# Registry Run keys
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s

# Scheduled tasks
schtasks /query /fo CSV /v > schtasks_all.csv

# WMI event subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

# Services
Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName

# Linux persistence
cat /etc/crontab
ls -la /etc/cron.*/
ls -la /etc/init.d/
systemctl list-unit-files --type=service | grep enabled
cat /etc/rc.local
ls -la ~/.bashrc ~/.profile ~/.bash_profile

步骤 2：识别所有恶意软件痕迹

# Scan with YARA rules specific to the malware family
yara -r -s malware_rules/specific_family.yar C:\ 2>/dev/null

# Scan with multiple AV engines
# ClamAV scan
clamscan -r --infected --remove=no /mnt/infected_disk/

# Check for known malicious file hashes
find / -type f -newer /tmp/baseline_timestamp -exec sha256sum {} \; 2>/dev/null | \
  while read hash file; do
    grep -q "$hash" known_malicious_hashes.txt && echo "MALICIOUS: $file ($hash)"
  done

# Check for web shells
find /var/www/ -name "*.php" -newer /tmp/baseline -exec grep -l "eval\|base64_decode\|system\|passthru\|shell_exec" {} \;

# Check for unauthorized SSH keys
find / -name "authorized_keys" -exec cat {} \; 2>/dev/null

步骤 3：移除恶意软件文件和痕迹

# Remove identified malicious files (after forensic imaging)
# Windows
Remove-Item -Path "C:\Windows\Temp\malware.exe" -Force
Remove-Item -Path "C:\Users\Public\backdoor.dll" -Force

# Remove malicious scheduled tasks
schtasks /delete /tn "MaliciousTaskName" /f

# Remove WMI persistence
Get-WMIObject -Namespace root\Subscription -Class __EventFilter -Filter "Name='MalFilter'" | Remove-WMIObject
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer -Filter "Name='MalConsumer'" | Remove-WMIObject

# Remove malicious registry entries
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MalEntry" /f

# Remove malicious services
sc stop "MalService" && sc delete "MalService"

# Linux - Remove malicious cron entries, binaries, SSH keys
crontab -r  # Remove entire crontab (or edit specific entries)
rm -f /tmp/.hidden_backdoor
sed -i '/malicious_key/d' ~/.ssh/authorized_keys
systemctl disable malicious-service && rm /etc/systemd/system/malicious-service.service

步骤 4：重置已泄露的凭据

# Reset all compromised user passwords
Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "OU=CompromisedUsers,DC=domain,DC=com" |
  Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString "TempP@ss!$(Get-Random)" -AsPlainText -Force)

# Reset KRBTGT password (twice, 12+ hours apart for Kerberos golden ticket attack)
Reset-KrbtgtPassword -DomainController DC01
# Wait 12+ hours, then reset again
Reset-KrbtgtPassword -DomainController DC01

# Rotate service account passwords
Get-ADServiceAccount -Filter * | ForEach-Object {
  Reset-ADServiceAccountPassword -Identity $_.Name
}

# Revoke all Azure AD tokens
Get-AzureADUser -All $true | ForEach-Object {
  Revoke-AzureADUserAllRefreshToken -ObjectId $_.ObjectId
}

# Rotate API keys and secrets
# Application-specific credential rotation

步骤 5：修补用于初始访问的漏洞

# Identify and patch the entry point vulnerability
# Windows Update
Install-WindowsUpdate -KBArticleID "KB5001234" -AcceptAll -AutoReboot

# Linux patching
apt update && apt upgrade -y  # Debian/Ubuntu
yum update -y                 # RHEL/CentOS

# Application-specific patches
# Update web application frameworks, CMS, etc.

# Verify patch was applied
Get-HotFix -Id "KB5001234"

步骤 6：验证根除效果

# Full system scan with updated signatures
# CrowdStrike Falcon - On-demand scan
curl -X POST "https://api.crowdstrike.com/scanner/entities/scans/v1" \
  -H "Authorization: Bearer $FALCON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["device_id"]}'

# Verify no persistence mechanisms remain
autorunsc.exe -accepteula -a * -c -h -s -v | findstr /i "unknown verified"

# Check for any remaining suspicious processes
Get-Process | Where-Object {$_.Path -notlike "C:\Windows\*" -and $_.Path -notlike "C:\Program Files*"}

# Verify no unauthorized network connections
Get-NetTCPConnection -State Established |
  Where-Object {$_.RemoteAddress -notlike "10.*" -and $_.RemoteAddress -notlike "172.16.*"} |
  Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess

# Run YARA rules again to confirm no artifacts remain
yara -r malware_rules/specific_family.yar C:\ 2>/dev/null

关键概念

概念	描述
持久化机制	攻击者用于在重启后维持访问的方法
根本原因修复	修复导致初始入侵的漏洞
凭据轮换	重置所有可能已泄露的密码和令牌
KRBTGT 重置	在黄金票据攻击后使 Kerberos 票据失效
指标扫描	扫描所有系统以查找已知恶意痕迹
验证扫描	在恢复前确认根除成功
重新镜像	从干净镜像重建系统，而非清理

工具与系统

工具	用途
Sysinternals Autoruns	枚举所有 Windows 自启动位置
YARA	基于自定义规则的恶意软件扫描
CrowdStrike/SentinelOne	基于 EDR 的扫描与修复
ClamAV	开源防病毒扫描
PowerShell	脚本化清理与验证
Velociraptor	远程痕迹收集与修复

常见场景

1. 具有多重持久化的 RAT：远程访问木马使用注册表、计划任务和 WMI 订阅。必须移除全部三种持久化机制。
2. IIS/Apache 上的 Web Shell：Web 根目录中的 PHP/ASPX Web Shell。移除 Shell，审计所有 Web 文件，修补应用程序漏洞。
3. Rootkit 感染：可抵御清理的内核级 Rootkit。需要从已知良好的介质进行完整重新镜像。
4. 无文件恶意软件：基于 PowerShell 的攻击驻留在内存和注册表中。移除注册表项，清除 WMI 订阅，重启系统。
5. Active Directory 入侵：攻击者创建了后门账户和黄金票据。重置 KRBTGT，移除恶意账户，审计组成员身份。

输出格式

• 根除操作日志，包含所有已移除的痕迹
• 凭据轮换确认报告
• 漏洞修补验证
• 根除后验证扫描结果
• 已清除并可为恢复阶段准备的系统