Remediation

2 posts

• 2026-03-29

  T1218.005 - msxsl Abuse - Host Recovery & Mitigation Plan

  Remediation steps for cleaning up msxsl.exe and more_eggs persistence, including registry cleanup, file removal, and credential reset procedures.

  T1218.005Detection & ResponseRemediation 1 min read
  →
• 2026-03-29

  T1068 - gdrv.sys - Removal and Blocklist Validation

  Remediation checklist for removing the vulnerable gdrv.sys driver, validating EDR quarantine, and enforcing the Microsoft kernel-mode driver blocklist.

  T1068Detection & ResponseRemediation 1 min read
  →