Handling and Responding to Endpoint Security Incidents
Endpoint incidents and telemetry
Incidents include malware and ransomware execution, unauthorised software, USB-borne compromise, privilege escalation, credential dumping, persistence installation and lateral movement. Know the telemetry each tool gives you: AV (signature and heuristics), EDR (process trees, command lines, module loads, network connections, remote-response shell), HIDS/HIPS, host firewall, application allow-listing, patch management, and Windows event logs.
Windows and Linux artefacts worth memorising
Windows: 4624 successful logon (and the logon types - 2 interactive, 3 network, 10 RDP), 4625 failed logon, 4688 process creation with command line, 4672 special privileges assigned, 7045 new service installed, plus Sysmon (process creation, network, registry). Also Autoruns locations: Run keys, startup folder, scheduled tasks, services, WMI subscriptions, Image File Execution Options. Linux: /var/log/auth.log or /var/log/secure, cron/systemd timers, ~/.bash_history, ps, ss/netstat, lsof, chkrootkit/rkhunter.
Live response on a host
Capture the volatile state before shutdown: memory image, running processes and command lines, network connections, loaded modules, logged-on users, scheduled tasks, services, and autoruns. Isolate the host from the network (EDR network containment or switch-port disable) rather than powering it off - modern attacks live in memory and a shutdown erases exactly the evidence you need. Use trusted, external tools; do not rely on the suspect system's own binaries.
Traps: turning the machine off “to be safe”; deleting the malicious file before imaging; assuming a clean AV scan means eradication (persistence may remain); forgetting to check for additional compromised hosts the endpoint authenticated to.
Worked example: EDR flags rundll32.exe spawning from a Word document. Isolate via EDR, capture memory and the process tree, collect the dropped binary hash and the scheduled task it created, then search the estate for that hash and task name before reimaging and rotating the user's credentials.