Recovery means removing the attacker completely before restoring service. Rebuild compromised systems from known good sources and change all credentials the attacker may have seen.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Find and close the initial access point
- Rebuild rather than clean where possible
- Monitor closely after restoring
Making it stick
Restoring too early often lets the attacker back in. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.