An incident responder discovers an attacker established persistence via a scheduled task that downloads and executes a payload from an external server at startup. What is the CORRECT sequence of eradication steps?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to find every persistence mechanism, remove the task and malware, block the attacker's URL, and verify the system is clean before production. Rebooting too soon can wake up other backdoors, and leaving a disabled task in place is still a risk.
Full Explanation
The correct sequence is to identify all persistence mechanisms, remove the scheduled task and associated malware, block the external URL at the perimeter, then verify no other backdoors remain before returning to production. The delete-the-task-then-reboot approach is wrong because rebooting before fully identifying all persistence mechanisms may trigger other backdoors. The immediate-reimage approach is wrong because reimaging without investigation misses the full attack scope and may not address all affected systems. The disable-without-deleting approach is wrong because resuming operations with a disabled but not removed backdoor is dangerous.