A new tool aimed at streamlining cyber incident response and helping organizations evict adversaries from compromised systems has been released by the US Cybersecurity and Infrastructure Security Agency (CISA).
The Eviction Strategies Tool is a free resource developed in collaboration with MITRE to support defenders in building rapid, tailored response plans.
Designed with ease of use and speed in mind, the Eviction Strategies Tool allows cyber defenders to craft detailed playbooks for containing and removing threat actors. Users can develop plans in minutes using either structured frameworks, such as MITRE ATT&CK, or free-text descriptions of threat behavior.
The tool integrates two key resources:
-
COUN7ER – a curated database of over 100 post-compromise countermeasures, mapped to known tactics, techniques and procedures (TTPs)
-
Cyber Eviction Strategies Playbook NextGen – a web-based interface that aligns incident findings with recommended countermeasures
Combined, these components aim to offer cyber teams a clear path to action, supporting decisions with researched, atomic-level guidance for every phase of adversary eviction.
Read more on adversary TTPs: SEC Charges Tech Firms Over Misleading SolarWinds Hack Disclosures
Practical Benefits for Defenders
CISA emphasized the importance of the tool in addressing long-standing challenges faced by incident responders.
“How an organization approaches remediation and eviction of an incident is critically important to a successful response effort,” said Jermaine Roebuck, associate director for threat hunting at CISA.
“This tool will level the playing field by making it easier for IT staff and cyber defenders to coordinate efforts and achieve a successful eviction.”
Key capabilities include:
-
Exporting plans in formats such as JSON, Word, Excel and markdown
-
Integrating knowledge from frameworks like MITRE D3FEND
-
Offering open-source access under the MIT License
CISA is inviting public and private sector organizations to incorporate the tool into their incident response workflows and provide feedback via an anonymous survey.
The agency said the launch of the Eviction Strategies Tool marks a strategic step in enhancing nationwide cyber-resilience, particularly against state-sponsored actors like Volt Typhoon and APT29.
By lowering the barrier to effective response planning, CISA hopes to help organizations reduce dwell time of attackers, limit damage and strengthen their overall defense posture.