D3fend Restore

D3FEND — Restore

When to Use

• Restoring user access after incident containment (reissue credentials, unlock accounts)
• Recovering files, databases, and configurations from backup
• Rebuilding systems from disk images or clean baselines
• Restoring email and software after malware removal
• Validating restored systems before returning to production
• Documenting recovery actions for post-incident review

When NOT to Use

• Active incident containment or eviction → d3fend-evict
• Detection engineering or monitoring → d3fend-detect
• Hardening to prevent future incidents → d3fend-harden
• Backup strategy design → infrastructure-engineer
• Business continuity planning → cybersecurity

Core Workflows

1. Restore Access

See `references/restore_access.md`

2. Restore Objects

• Restore file (from backup, shadow copy, or clean source)
• Restore email (from archive or backup)
• Restore database (point-in-time recovery, transaction log replay)
• Restore disk image (bare metal restore, VM snapshot)
• Restore configuration (from version control or backup)

See `references/restore_objects.md`

3. Restore Software & Systems

• Reinstall software from trusted source
• Rebuild system from hardened gold image
• Verify integrity (hash check, signature validation)
• Re-apply patches and updates
• Re-run vulnerability scan before rejoining network

See `references/restore_systems.md`

When to load references

• Restore access → references/restore_access.md
• Restore objects → references/restore_objects.md
• Restore systems → references/restore_systems.md

Restore Access

Technique Coverage

Access Restoration

Credential Reissuance

Verify identity: Out-of-band confirmation
Generate new: Strong random, appropriate type
Distribute securely: Password manager, secure email
Monitor: Watch for use of old credentials
Notify: User and security team

Account Unlock

Network Access Restoration

• Remove firewall blocks (if temporary)
• Re-enable VPN access
• Verify no persistence remains
• Confirm clean security scan
• Document restoration in incident timeline

Validation Before Restore

• [ ] Threat fully contained
• [ ] No persistent access remains
• [ ] User identity verified
• [ ] New credentials issued
• [ ] Systems scanned clean
• [ ] Monitoring in place

Restore Objects

Technique Coverage

Recovery Procedures

File Recovery

Database Recovery

Point-in-time: Restore to moment before incident
Transaction log: Replay logs to current state
Validation: Check consistency, run DBCC/repair
Testing: Verify application connectivity

Configuration Recovery

Disk Image Recovery

1. Select verified clean gold image 2. Verify image integrity (hash check) 3. Deploy to clean hardware 4. Apply latest patches 5. Restore data from clean backup 6. Verify before production

Integrity Verification

Before restore: Verify backup/source is clean
After restore: Compare hashes to known-good
Ongoing: Run vulnerability scan on restored system

Restore Software & Systems

System Rebuild Process

From Gold Image

1. Select verified, hardened gold image
2. Verify image signature and integrity
3. Deploy to clean infrastructure
4. Join domain / configure identity
5. Apply latest OS and app patches
6. Install required software from approved sources
7. Restore data from clean backup
8. Run security scan (vulnerability + malware)
9. Verify functionality
10. Document and re-authorize for production

Software Reinstallation

Rejoining Production

Pre-return Checklist

• [ ] Malware scan: Clean
• [ ] Vulnerability scan: Acceptable risk
• [ ] Configuration: Matches hardened baseline
• [ ] Patching: Current as of rejoin date
• [ ] Monitoring: Agent installed and reporting
• [ ] Logging: Forwarding to SIEM
• [ ] Backup: New backup taken post-restore
• [ ] Documentation: Recovery actions logged

Phased Return

Phase 1: Isolated test environment
Phase 2: Limited user pilot
Phase 3: Full production access
Phase 4: Remove temporary restrictions

Lessons Learned

Document after every restoration:

• Root cause of compromise
• Time to detect, contain, and restore
• What worked well
• What needs improvement
• Updates to playbooks and procedures