Contain, eradicate, recover

Investigation is only half the job

Once an incident is confirmed, the analyst acts. The lifecycle is: contain (cut the attacker's access), eradicate (remove every foothold they left), then recover (restore normal service).

1. Contain — block the attacker IP so it can't reconnect.
2. Eradicate — lock the breached account, delete the backdoor account and the web shell.
3. Recover — confirm the footholds are gone and hand over.

Blocking a source over TCP wrappers is a classic quick containment — append it to /etc/hosts.deny:

echo 'sshd: 203.0.113.66' | sudo tee -a /etc/hosts.deny

In the terminal

student@vulntech:~$ echo 'sshd: 203.0.113.66' | sudo tee -a /etc/hosts.deny
[sudo] password for student:
sshd: 203.0.113.66

Tip: Order matters: contain before you eradicate, so the attacker can't simply re-establish access while you are cleaning up.