How do I install the D3fend Evict skill?

Run npx skillmds@latest add daemon-blockint-tech/d3fend-evict in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is D3fend Evict safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with D3fend Evict?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is D3fend Evict free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published D3fend Evict?

daemon-blockint-tech (@daemon-blockint-tech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

D3fend Evict by daemon-blockint-tech

Name: D3fend Evict
Author: daemon-blockint-tech

D3fend Evict

Guides cybersecurity eviction and incident response using MITRE D3FEND—credential revocation, account locking, process termination, file removal, and system recovery. Covers containment actions during incidents: killing malicious processes, revoking compromised credentials, removing persistent files, and restoring systems. Use during active incident response, containment, eradication—not for detection (d3fend-detect), hardening (d3fend-harden), or forensic investigation (incident-management-engineer).

File contents

D3FEND — Evict

When to Use

Responding to active security incidents requiring containment
Revoking compromised credentials and locking accounts
Terminating malicious processes and sessions
Removing malicious files, registry keys, and email
Evicting adversary presence (shutdown, reboot, disk operations)
Coordinating takedowns (domain registration, DNS cache)

When NOT to Use

Building detection or monitoring → d3fend-detect
System hardening or prevention → d3fend-harden
Network segmentation → d3fend-isolate
Forensic investigation and evidence preservation → incident-management-engineer
Post-incident recovery and restoration → d3fend-restore

Core Workflows

1. Credential Eviction

Action	When	Considerations
Account locking	Immediate containment	May disrupt business; have unlock procedure
Authentication cache invalidation	Session hijacking confirmed	Force re-auth across all systems
Credential revocation	Stolen cert/token	Update CRL, rotate secrets

See references/credential_eviction.md

2. Object & File Eviction

File eviction (quarantine, delete, restore from clean backup)
Email removal (phishing, malware delivery)
Registry key deletion (persistence removal)
DNS cache eviction (poisoning response)
Domain registration takedown (phishing sites)

See references/object_eviction.md

3. Process & System Eviction

Process suspension (pause for analysis)
Process termination (kill malicious process)
Session termination (disconnect attacker)
Host shutdown/reboot (emergency containment)
Disk operations (format, erase, partition for sanitization)

See references/process_system_eviction.md

When to load references

Credential eviction → references/credential_eviction.md
Object & file eviction → references/object_eviction.md
Process & system eviction → references/process_system_eviction.md

---name: d3fend-evictdescription: Guides cybersecurity eviction and incident response using MITRE D3FEND—credential revocation, account locking, process termination, file removal, and system recovery. Covers containment actions during incidents: killing malicious processes, revoking compromised credentials, removing persistent files, and restoring systems. Use during active incident response, containment, eradication—not for detection (d3fend-detect), hardening (d3fend-harden), or forensic investigation (incident-management-engineer).---# D3FEND — Evict## When to Use- Responding to active security incidents requiring containment- Revoking compromised credentials and locking accounts- Terminating malicious processes and sessions- Removing malicious files, registry keys, and email- Evicting adversary presence (shutdown, reboot, disk operations)- Coordinating takedowns (domain registration, DNS cache)## When NOT to Use- Building detection or monitoring → `d3fend-detect`- System hardening or prevention → `d3fend-harden`- Network segmentation → `d3fend-isolate`- Forensic investigation and evidence preservation → `incident-management-engineer`- Post-incident recovery and restoration → `d3fend-restore`## Core Workflows### 1. Credential Eviction| Action | When | Considerations ||---|---|---|| Account locking | Immediate containment | May disrupt business; have unlock procedure || Authentication cache invalidation | Session hijacking confirmed | Force re-auth across all systems || Credential revocation | Stolen cert/token | Update CRL, rotate secrets |**See `references/credential_eviction.md`**### 2. Object & File Eviction- File eviction (quarantine, delete, restore from clean backup)- Email removal (phishing, malware delivery)- Registry key deletion (persistence removal)- DNS cache eviction (poisoning response)- Domain registration takedown (phishing sites)**See `references/object_eviction.md`**### 3. Process & System Eviction- Process suspension (pause for analysis)- Process termination (kill malicious process)- Session termination (disconnect attacker)- Host shutdown/reboot (emergency containment)- Disk operations (format, erase, partition for sanitization)**See `references/process_system_eviction.md`**## When to load references- **Credential eviction** → `references/credential_eviction.md`- **Object & file eviction** → `references/object_eviction.md`- **Process & system eviction** → `references/process_system_eviction.md`

Frequently asked questions