CNDA: Endpoint and Host Defense

This domain tests hardening and the telemetry endpoints produce. Expect items on baselines, patching, privilege, application control, and which event source would actually show a given behaviour.

Core rules

• Baselines first. CIS Benchmarks or vendor STIGs give a documented, auditable configuration; deviations need an exception record.
• Patch by risk, not by calendar alone. Externally exposed and actively exploited vulnerabilities get out-of-band treatment; track mean time to remediate.
• Remove standing admin rights. Use just-in-time elevation and separate admin accounts from daily-use accounts.
• Application control beats blacklisting. AppLocker or WDAC allowlisting blocks unapproved binaries, including many living-off-the-land abuses when script rules are enforced.
• AV is signature-based; EDR adds behavioural analytics, memory inspection, and response actions such as host isolation and process termination.
• Protect credentials at rest and in memory: full-disk encryption, Secure Boot, LSA protection, Credential Guard, restricted NTLM.
• Know your event IDs. 4624 successful logon (Type 3 network, Type 10 RDP), 4625 failure, 4672 special privileges assigned, 4688 process creation with command-line auditing, 7045 service installed. Sysmon: 1 process create, 3 network connect, 8 CreateRemoteThread, 10 process access, 11 file create, 22 DNS query.

Worked example

An analyst suspects LSASS credential dumping. Which telemetry confirms it?

Reasoning: start from behaviour, not tool names. Dumping requires a process to open a handle to lsass.exe with read access - Sysmon Event ID 10 with TargetImage lsass.exe and GrantedAccess containing 0x1010 or 0x1410 is the strongest single indicator. Corroborate with Event ID 1 for the source process and its command line, Event ID 11 for a .dmp file written to a temp path, and 4624 Type 3 logons from that host shortly afterwards. Each event alone is weak; handle access plus a dump file plus follow-on authentication forms a chain. Containment is host isolation and credential reset for accounts logged on to that host.

Traps

• Assuming EDR replaces patching, or that a green AV console means the host is clean.
• Excluding system or temp directories from scanning for performance reasons.
• Missing that service accounts and scheduled tasks are privilege-escalation paths.
• Reading 4625 failures as an attack without checking whether the account locked out or a 4624 followed.
• Forgetting that memory-resident malware leaves few disk artefacts, so volatile data matters.