Host-Based Analysis with Secure Endpoint
Host-Based Analysis asks you to interpret endpoint telemetry and choose a proportionate response. The toolset is Cisco Secure Endpoint (formerly AMP for Endpoints) backed by Secure Malware Analytics for dynamic analysis, plus the Windows and Linux artifacts any responder must read.
How detection is layered
- Cloud reputation and prevalence: a file's verdict and how many other machines have executed it. Prevalence of one, first seen today, is a strong signal.
- Behavioral and exploit protection: catches post-exploitation actions such as process injection, credential dumping and script-based attacks even when no malicious file exists.
- Retrospective detection: when a verdict changes in the cloud, the console raises alerts for files already executed historically. This is why a file can look clean for a week and then alarm.
- Trajectory: device trajectory shows the process tree with ancestors and command lines; file trajectory shows every device that executed the file and first-seen timing.
Artifacts to request or read
Windows: 4688 process creation with command line, 4624 logon with type 10 for RDP, 7045 service installation, PowerShell script block logging 4104, Run keys and scheduled tasks for persistence. Sysmon event IDs 1, 3, 11 and 22 give process, network, file and DNS visibility.
Worked example
An alert fires for a document opened by excel.exe. Reasoning: first check file trajectory, since prevalence of one and a same-day first-seen date argue for targeted malware. Then read device trajectory to see whether excel.exe was itself launched by outlook.exe, which makes the email the delivery vector. Crucially, determine whether the event was blocked or executed: a blocked execution is a low-urgency cleanup, while an executed payload means isolate the host, capture volatile memory, enumerate autoruns and persistence, then submit the hash to Secure Malware Analytics. Only after scoping do you rebuild.
Response actions and traps
Quarantine, block by SHA-256, file allow/deny lists, exclusions, network isolation that keeps the agent's management tunnel open, live search queries and snapshots. Frequent mistakes: reading every 'Threat Detected' entry as an infection; adding a folder exclusion to silence a false positive, which creates a permanent blind spot (use a hash allow list instead); dismissing fileless detections because no file was written; and treating a hash as a durable IOC after the actor recompiles.