D3fend Evict

D3FEND — Evict

When to Use

• Responding to active security incidents requiring containment
• Revoking compromised credentials and locking accounts
• Terminating malicious processes and sessions
• Removing malicious files, registry keys, and email
• Evicting adversary presence (shutdown, reboot, disk operations)
• Coordinating takedowns (domain registration, DNS cache)

When NOT to Use

• Building detection or monitoring → d3fend-detect
• System hardening or prevention → d3fend-harden
• Network segmentation → d3fend-isolate
• Forensic investigation and evidence preservation → incident-management-engineer
• Post-incident recovery and restoration → d3fend-restore

Core Workflows

1. Credential Eviction

See `references/credential_eviction.md`

2. Object & File Eviction

• File eviction (quarantine, delete, restore from clean backup)
• Email removal (phishing, malware delivery)
• Registry key deletion (persistence removal)
• DNS cache eviction (poisoning response)
• Domain registration takedown (phishing sites)

See `references/object_eviction.md`

3. Process & System Eviction

• Process suspension (pause for analysis)
• Process termination (kill malicious process)
• Session termination (disconnect attacker)
• Host shutdown/reboot (emergency containment)
• Disk operations (format, erase, partition for sanitization)

See `references/process_system_eviction.md`

When to load references

• Credential eviction → references/credential_eviction.md
• Object & file eviction → references/object_eviction.md
• Process & system eviction → references/process_system_eviction.md

Credential Eviction

Technique Coverage

Eviction Procedures

Account Locking

Trigger: Confirmed compromise or suspicious activity
Action: Disable account in AD/IdP
Notification: User + security team
Unlock: After verification + credential reset
Consideration: May disrupt business - plan for emergency access

Authentication Cache Invalidation

Credential Revocation

Coordination Checklist

• [ ] Identify all systems using the credential
• [ ] Revoke/rotate in identity provider first
• [ ] Clear all cached sessions
• [ ] Verify no active sessions remain
• [ ] Issue new credentials through secure channel
• [ ] Monitor for attempts to use old credentials

Object & File Eviction

Technique Coverage

File Eviction

Quarantine vs Delete

Registry Cleanup

Common persistence locations:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Services (legitimate names, malicious binaries)
WMI event subscriptions
Scheduled tasks

Email Removal

• Delete from all mailboxes
• Purge from recoverable items
• Block sender domain
• Update email gateway rules

DNS & Domain

Disk Operations

Process & System Eviction

Technique Coverage

Process Eviction

Suspension vs Termination

Termination Methods

Graceful: SIGTERM, service stop
Forceful: SIGKILL, taskkill /F
Kernel: Delete process object
Remote: EDR kill command

Session Termination

System Eviction

Shutdown

• Immediate: Cut power (last resort)
• Graceful: shutdown /s /t 0
• Network: Isolate first, then shutdown

Reboot

• Use for: Clearing memory-resident malware
• Risk: Persistent malware restarts
• Combine with: Boot from clean media

Coordination

1. Identify all malicious processes 2. Document parent-child relationships 3. Terminate in dependency order (children first) 4. Verify termination (process not respawning) 5. Check for persistence mechanisms 6. Verify system stability after eviction