Endpoint Detection and Response
Endpoint Detection and Response
This domain tests endpoint telemetry literacy: which events answer which question, how process ancestry exposes an attack, and what live response actions are available and when to use them. Questions commonly show a process tree or an event excerpt and ask for the assessment.
Telemetry that matters
- Process creation with full command line and parent identifier - the backbone of endpoint detection. In Windows, Sysmon Event ID 1 or Security 4688 with command-line auditing enabled.
- Network connections per process (Sysmon ID 3), file creation (ID 11), registry modification (ID 12/13), image and driver loads (ID 6/7), remote thread creation (ID 8), process access (ID 10).
- Script visibility: PowerShell script block logging Event ID 4104 and AMSI provide content that command-line logging alone misses.
- Authentication context: 4624 logon types - 2 interactive, 3 network, 10 remote interactive - tell you how the actor arrived.
Analytic patterns
Office or PDF readers spawning command shells, script hosts or rundll32 are high-signal. So are living-off-the-land binaries used against their purpose: certutil for download, mshta for remote HTA execution, regsvr32 with scrobj.dll, rundll32 with a temp path, powershell with -nop -w hidden -enc. Credential access shows as a non-allowlisted process opening lsass.exe. Persistence shows as Run keys, new services, scheduled tasks and WMI subscriptions created shortly after a suspicious parent process.
Response actions
EDR supports host isolation from the console, process termination, hash and path blocking, live triage collection of running processes, autoruns and memory, and remote shell for scoped investigation. Isolation cuts the host from the network but usually retains the management channel. Terminating a process before collection can destroy injected code still resident in memory; collect first where the incident warrants it.
Worked example: a document reader process spawns cmd.exe, which spawns powershell with an encoded command, which spawns rundll32 executing a DLL in a user temp folder, and that process connects to an external IP on 443. Each link in the chain is individually common; the sequence is not. You isolate the host, collect the process tree, memory and the dropped DLL, block the hash and destination, and hunt the same parent-child pattern estate-wide.
Traps: judging by filename instead of hash and behaviour; ignoring parent-child relationships; confusing block with isolate; assuming 4104 data exists when script block logging was never enabled; terminating processes before capturing volatile evidence.