ETMD EP Practitioners cheat sheet

MITRE ATT&CK enterprise tactics run in order from Reconnaissance and Resource Development (pre-compromise) through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Fileless techniques (PowerShell, WMI, .NET assembly loading, registry-resident payloads) leave no executable on disk; detection depends on script-block logging, module load events, and process ancestry rather than file scanning.

Living-off-the-land binaries (LOLBins) such as certutil, mshta, rundll32, regsvr32, and bitsadmin are signed OS components; their presence is normal, so verdicts hinge on command-line arguments and parent process.

Ransomware execution typically precedes encryption with shadow copy deletion (vssadmin delete shadows), backup service tampering, and mass file rename; these precursors are higher-fidelity alerts than encryption itself.

Signature-based detection fails against polymorphic and packed malware; behavioral and machine-learning engines score on action sequences, so a low-prevalence binary making credential-access API calls should still alert.

Endpoint telemetry categories: process creation with command line, network connection with owning process, file create/modify, registry modification, image/module load, and authentication events. Absence of any one category defines a blind spot.

Initial access vectors on endpoints: phishing payloads, exploitation of exposed services, valid-account abuse, removable media, and supply-chain software. Each maps to distinct detection surfaces (mail gateway, patch level, logon anomaly, device control, application control).

Threat actor tiers: commodity/ransomware crews reuse public tooling and prioritize volume; targeted intrusion sets use custom implants and long dwell time. Triage priority and containment urgency differ by tier, not by alert severity label alone.

Agent deployment order: verify OS and kernel support, confirm network egress to the management console and update servers, install, confirm policy assignment, then validate telemetry arrival before scaling to the next ring.

Staged rollout rings: pilot (IT/security), early adopter (5-10% of fleet), broad production, then legacy or high-risk exceptions. Each ring requires a defined soak period and rollback criterion before the next expands.

Preventive modules to configure explicitly: on-access malware scanning, exploit protection (ASLR, DEP, CFG enforcement), application control/allowlisting, device control, web/network protection, and tamper protection.

Tamper protection must be enabled before policy tuning; otherwise local administrators or malware can disable real-time scanning, alter exclusions, or uninstall the agent.

Agent health states to monitor: installed but not reporting, reporting but policy out of date, protection modules disabled, signature/definition age beyond threshold, and pending reboot for kernel-level updates.

Cloud-delivered vs on-premises console changes update latency and egress requirements; cloud consoles typically need HTTPS 443 to vendor endpoints plus a defined proxy or PAC configuration.

Definition and engine updates should follow a separate cadence from policy changes so a bad signature can be rolled back without reverting configuration.

Uninstall and reinstall require protection against unauthorized removal: uninstall passwords or console-issued tokens, and re-enrollment validation to prevent orphaned or duplicate device records.

Triage order for an endpoint alert: confirm the detection is real (telemetry, hash, command line), identify the affected host and user, determine whether the action was blocked or allowed, then decide escalation.

Blocked detections are contained by the product but still indicate attempted execution; allowed detections require immediate host isolation because prevention failed.

Severity is a product of confidence, impact potential, and spread risk. A medium-confidence credential-dumping alert on a domain controller outranks a high-confidence adware alert on a workstation.

Isolation options: network containment through the console (preserves agent channel), full host quarantine, or account disable. Choose containment that stops lateral movement while preserving forensic access.

Evidence to capture before remediation: process tree, command lines, loaded modules, network connections, persistence locations (run keys, scheduled tasks, services), and memory image if the host will be rebuilt.

Incident lifecycle: detection, triage, containment, eradication, recovery, and lessons learned. Each phase needs an owner and an exit criterion; skipping eradication causes recurrence.

False positive handling: document the triggering logic, add the narrowest possible exclusion or tune the rule threshold, and record the change with justification for audit.

Escalation triggers to a full incident: multiple hosts with the same detection, detection on a privileged account or server, evidence of lateral movement, or any confirmed data access.

Hunt hypothesis structure: state the adversary behavior, the telemetry that would reveal it, the expected baseline, and the query. Example: 'Credential dumping via LSASS access - look for process opens of lsass.exe by non-allowlisted parents.'

Process ancestry analysis: suspicious parent-child pairs include Office applications spawning script interpreters, web servers spawning shells, and services spawning cmd or PowerShell.

Command-line hunting patterns: encoded PowerShell (-enc), download cradles (IEX, DownloadString), hidden windows (-w hidden), and base64 blobs longer than 100 characters.

Persistence hunt locations: Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions, startup folders, and logon scripts. Baseline counts per host make outliers visible.

Lateral movement indicators: PsExec service creation, WMI remote process creation, SMB admin share access, RDP logon type 10, and pass-the-hash (logon type 3 with NTLM to many hosts).

Living-off-the-land hunts should filter on argument anomalies rather than binary names; certutil with -urlcache -split -f indicates download behavior, not certificate management.

Stacking and frequency analysis: count occurrences of a field (parent process, command line, destination port) across the fleet and investigate rare values; rarity is a stronger signal than any single indicator.

Timeline reconstruction: normalize process, network, and authentication events to a single clock source (UTC) and order by time to determine initial execution versus later impact.

Exclusion types: path, file extension, process, hash, and command-line. Prefer hash or certificate-based exclusions over broad path exclusions because paths can be written to by attackers.

Every exclusion is a permanent blind spot; require a business justification, an owner, an expiry/review date, and a compensating control (application control or network segmentation).

Never exclude user-writable directories (temp, downloads, user profiles) or system-wide interpreters wholesale; these are the locations malware uses to bypass scanning.

Tuning sequence: validate the rule logic, check prevalence across the fleet, adjust thresholds or scoping, and only then consider suppression. Suppressing before tuning hides real detections.

Policy precedence: most-specific policy or group assignment wins; document the inheritance order so a test policy does not silently override production settings.

Performance tuning levers: scan concurrency, CPU throttling, archive depth and size limits, and on-write vs on-access scanning. Measure before and after with the same workload.

Change control for policy: stage in a test group, define success metrics (false positive rate, agent CPU, detection coverage), schedule the rollout window, and record a rollback plan.

Exclusion review cadence: quarterly inventory of all exclusions with last-used date; remove exclusions for software no longer installed and re-validate those older than one year.

Core operational metrics: agent coverage percentage (managed devices vs known inventory), definition currency (agents updated within 24-48 hours), policy compliance rate, and detection-to-triage time.

Detection quality metrics: true positive rate, false positive rate per rule, mean time to triage, mean time to contain, and repeat-alert rate for the same rule and host.

Coverage gap analysis compares the endpoint inventory (CMDB, Active Directory, network discovery) against console-managed devices; any unmanaged host is an unreported risk.

SLA definitions: critical alerts triaged within 15-30 minutes, high within 1 hour, medium within 4-8 hours; containment targets should be defined separately from triage targets.

Audit evidence to retain: policy versions with change history, exclusion lists with justification, alert records with disposition, incident reports, and agent deployment logs.

Regulatory mapping: PCI DSS requires anti-malware on all systems and retained logs; HIPAA requires audit controls and integrity protection; ISO 27001 requires documented endpoint controls and review records.

Report audiences differ: executives need coverage and risk trend, operations needs alert volume and SLA adherence, auditors need control evidence and exception approvals.

Backup and continuity: retain console configuration exports and exclusion lists so a console rebuild does not lose policy state; test restoration of reporting data.

MITRE ATT&CK enterprise tactics run in order from Reconnaissance and Resource Development (pre-compromise) through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Fileless techniques (PowerShell, WMI, .NET assembly loading, registry-resident payloads) leave no executable on disk; detection depends on script-block logging, module load events, and process ancestry rather than file scanning.

Living-off-the-land binaries (LOLBins) such as certutil, mshta, rundll32, regsvr32, and bitsadmin are signed OS components; their presence is normal, so verdicts hinge on command-line arguments and parent process.

Ransomware execution typically precedes encryption with shadow copy deletion (vssadmin delete shadows), backup service tampering, and mass file rename; these precursors are higher-fidelity alerts than encryption itself.

Signature-based detection fails against polymorphic and packed malware; behavioral and machine-learning engines score on action sequences, so a low-prevalence binary making credential-access API calls should still alert.

Endpoint telemetry categories: process creation with command line, network connection with owning process, file create/modify, registry modification, image/module load, and authentication events. Absence of any one category defines a blind spot.

Initial access vectors on endpoints: phishing payloads, exploitation of exposed services, valid-account abuse, removable media, and supply-chain software. Each maps to distinct detection surfaces (mail gateway, patch level, logon anomaly, device control, application control).

Threat actor tiers: commodity/ransomware crews reuse public tooling and prioritize volume; targeted intrusion sets use custom implants and long dwell time. Triage priority and containment urgency differ by tier, not by alert severity label alone.

Agent deployment order: verify OS and kernel support, confirm network egress to the management console and update servers, install, confirm policy assignment, then validate telemetry arrival before scaling to the next ring.

Staged rollout rings: pilot (IT/security), early adopter (5-10% of fleet), broad production, then legacy or high-risk exceptions. Each ring requires a defined soak period and rollback criterion before the next expands.

Preventive modules to configure explicitly: on-access malware scanning, exploit protection (ASLR, DEP, CFG enforcement), application control/allowlisting, device control, web/network protection, and tamper protection.

Tamper protection must be enabled before policy tuning; otherwise local administrators or malware can disable real-time scanning, alter exclusions, or uninstall the agent.

Agent health states to monitor: installed but not reporting, reporting but policy out of date, protection modules disabled, signature/definition age beyond threshold, and pending reboot for kernel-level updates.

Cloud-delivered vs on-premises console changes update latency and egress requirements; cloud consoles typically need HTTPS 443 to vendor endpoints plus a defined proxy or PAC configuration.

Definition and engine updates should follow a separate cadence from policy changes so a bad signature can be rolled back without reverting configuration.

Uninstall and reinstall require protection against unauthorized removal: uninstall passwords or console-issued tokens, and re-enrollment validation to prevent orphaned or duplicate device records.

Triage order for an endpoint alert: confirm the detection is real (telemetry, hash, command line), identify the affected host and user, determine whether the action was blocked or allowed, then decide escalation.

Blocked detections are contained by the product but still indicate attempted execution; allowed detections require immediate host isolation because prevention failed.

Severity is a product of confidence, impact potential, and spread risk. A medium-confidence credential-dumping alert on a domain controller outranks a high-confidence adware alert on a workstation.

Isolation options: network containment through the console (preserves agent channel), full host quarantine, or account disable. Choose containment that stops lateral movement while preserving forensic access.

Evidence to capture before remediation: process tree, command lines, loaded modules, network connections, persistence locations (run keys, scheduled tasks, services), and memory image if the host will be rebuilt.

Incident lifecycle: detection, triage, containment, eradication, recovery, and lessons learned. Each phase needs an owner and an exit criterion; skipping eradication causes recurrence.

False positive handling: document the triggering logic, add the narrowest possible exclusion or tune the rule threshold, and record the change with justification for audit.

Escalation triggers to a full incident: multiple hosts with the same detection, detection on a privileged account or server, evidence of lateral movement, or any confirmed data access.

Hunt hypothesis structure: state the adversary behavior, the telemetry that would reveal it, the expected baseline, and the query. Example: 'Credential dumping via LSASS access - look for process opens of lsass.exe by non-allowlisted parents.'

Process ancestry analysis: suspicious parent-child pairs include Office applications spawning script interpreters, web servers spawning shells, and services spawning cmd or PowerShell.

Command-line hunting patterns: encoded PowerShell (-enc), download cradles (IEX, DownloadString), hidden windows (-w hidden), and base64 blobs longer than 100 characters.

Persistence hunt locations: Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions, startup folders, and logon scripts. Baseline counts per host make outliers visible.

Lateral movement indicators: PsExec service creation, WMI remote process creation, SMB admin share access, RDP logon type 10, and pass-the-hash (logon type 3 with NTLM to many hosts).

Living-off-the-land hunts should filter on argument anomalies rather than binary names; certutil with -urlcache -split -f indicates download behavior, not certificate management.

Stacking and frequency analysis: count occurrences of a field (parent process, command line, destination port) across the fleet and investigate rare values; rarity is a stronger signal than any single indicator.

Timeline reconstruction: normalize process, network, and authentication events to a single clock source (UTC) and order by time to determine initial execution versus later impact.

Exclusion types: path, file extension, process, hash, and command-line. Prefer hash or certificate-based exclusions over broad path exclusions because paths can be written to by attackers.

Every exclusion is a permanent blind spot; require a business justification, an owner, an expiry/review date, and a compensating control (application control or network segmentation).

Never exclude user-writable directories (temp, downloads, user profiles) or system-wide interpreters wholesale; these are the locations malware uses to bypass scanning.

Tuning sequence: validate the rule logic, check prevalence across the fleet, adjust thresholds or scoping, and only then consider suppression. Suppressing before tuning hides real detections.

Policy precedence: most-specific policy or group assignment wins; document the inheritance order so a test policy does not silently override production settings.

Performance tuning levers: scan concurrency, CPU throttling, archive depth and size limits, and on-write vs on-access scanning. Measure before and after with the same workload.

Change control for policy: stage in a test group, define success metrics (false positive rate, agent CPU, detection coverage), schedule the rollout window, and record a rollback plan.

Exclusion review cadence: quarterly inventory of all exclusions with last-used date; remove exclusions for software no longer installed and re-validate those older than one year.

Core operational metrics: agent coverage percentage (managed devices vs known inventory), definition currency (agents updated within 24-48 hours), policy compliance rate, and detection-to-triage time.

Detection quality metrics: true positive rate, false positive rate per rule, mean time to triage, mean time to contain, and repeat-alert rate for the same rule and host.

Coverage gap analysis compares the endpoint inventory (CMDB, Active Directory, network discovery) against console-managed devices; any unmanaged host is an unreported risk.

SLA definitions: critical alerts triaged within 15-30 minutes, high within 1 hour, medium within 4-8 hours; containment targets should be defined separately from triage targets.

Audit evidence to retain: policy versions with change history, exclusion lists with justification, alert records with disposition, incident reports, and agent deployment logs.

Regulatory mapping: PCI DSS requires anti-malware on all systems and retained logs; HIPAA requires audit controls and integrity protection; ISO 27001 requires documented endpoint controls and review records.

Report audiences differ: executives need coverage and risk trend, operations needs alert volume and SLA adherence, auditors need control evidence and exception approvals.

Backup and continuity: retain console configuration exports and exclusion lists so a console rebuild does not lose policy state; test restoration of reporting data.

MITRE ATT&CK enterprise tactics run in order from Reconnaissance and Resource Development (pre-compromise) through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Fileless techniques (PowerShell, WMI, .NET assembly loading, registry-resident payloads) leave no executable on disk; detection depends on script-block logging, module load events, and process ancestry rather than file scanning.

Living-off-the-land binaries (LOLBins) such as certutil, mshta, rundll32, regsvr32, and bitsadmin are signed OS components; their presence is normal, so verdicts hinge on command-line arguments and parent process.

Ransomware execution typically precedes encryption with shadow copy deletion (vssadmin delete shadows), backup service tampering, and mass file rename; these precursors are higher-fidelity alerts than encryption itself.

Signature-based detection fails against polymorphic and packed malware; behavioral and machine-learning engines score on action sequences, so a low-prevalence binary making credential-access API calls should still alert.

Endpoint telemetry categories: process creation with command line, network connection with owning process, file create/modify, registry modification, image/module load, and authentication events. Absence of any one category defines a blind spot.

Initial access vectors on endpoints: phishing payloads, exploitation of exposed services, valid-account abuse, removable media, and supply-chain software. Each maps to distinct detection surfaces (mail gateway, patch level, logon anomaly, device control, application control).

Threat actor tiers: commodity/ransomware crews reuse public tooling and prioritize volume; targeted intrusion sets use custom implants and long dwell time. Triage priority and containment urgency differ by tier, not by alert severity label alone.

Agent deployment order: verify OS and kernel support, confirm network egress to the management console and update servers, install, confirm policy assignment, then validate telemetry arrival before scaling to the next ring.

Staged rollout rings: pilot (IT/security), early adopter (5-10% of fleet), broad production, then legacy or high-risk exceptions. Each ring requires a defined soak period and rollback criterion before the next expands.

Preventive modules to configure explicitly: on-access malware scanning, exploit protection (ASLR, DEP, CFG enforcement), application control/allowlisting, device control, web/network protection, and tamper protection.

Tamper protection must be enabled before policy tuning; otherwise local administrators or malware can disable real-time scanning, alter exclusions, or uninstall the agent.

Agent health states to monitor: installed but not reporting, reporting but policy out of date, protection modules disabled, signature/definition age beyond threshold, and pending reboot for kernel-level updates.

Cloud-delivered vs on-premises console changes update latency and egress requirements; cloud consoles typically need HTTPS 443 to vendor endpoints plus a defined proxy or PAC configuration.

Definition and engine updates should follow a separate cadence from policy changes so a bad signature can be rolled back without reverting configuration.

Uninstall and reinstall require protection against unauthorized removal: uninstall passwords or console-issued tokens, and re-enrollment validation to prevent orphaned or duplicate device records.

Triage order for an endpoint alert: confirm the detection is real (telemetry, hash, command line), identify the affected host and user, determine whether the action was blocked or allowed, then decide escalation.

Blocked detections are contained by the product but still indicate attempted execution; allowed detections require immediate host isolation because prevention failed.

Severity is a product of confidence, impact potential, and spread risk. A medium-confidence credential-dumping alert on a domain controller outranks a high-confidence adware alert on a workstation.

Isolation options: network containment through the console (preserves agent channel), full host quarantine, or account disable. Choose containment that stops lateral movement while preserving forensic access.

Evidence to capture before remediation: process tree, command lines, loaded modules, network connections, persistence locations (run keys, scheduled tasks, services), and memory image if the host will be rebuilt.

Incident lifecycle: detection, triage, containment, eradication, recovery, and lessons learned. Each phase needs an owner and an exit criterion; skipping eradication causes recurrence.

False positive handling: document the triggering logic, add the narrowest possible exclusion or tune the rule threshold, and record the change with justification for audit.

Escalation triggers to a full incident: multiple hosts with the same detection, detection on a privileged account or server, evidence of lateral movement, or any confirmed data access.

Hunt hypothesis structure: state the adversary behavior, the telemetry that would reveal it, the expected baseline, and the query. Example: 'Credential dumping via LSASS access - look for process opens of lsass.exe by non-allowlisted parents.'

Process ancestry analysis: suspicious parent-child pairs include Office applications spawning script interpreters, web servers spawning shells, and services spawning cmd or PowerShell.

Command-line hunting patterns: encoded PowerShell (-enc), download cradles (IEX, DownloadString), hidden windows (-w hidden), and base64 blobs longer than 100 characters.

Persistence hunt locations: Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions, startup folders, and logon scripts. Baseline counts per host make outliers visible.

Lateral movement indicators: PsExec service creation, WMI remote process creation, SMB admin share access, RDP logon type 10, and pass-the-hash (logon type 3 with NTLM to many hosts).

Living-off-the-land hunts should filter on argument anomalies rather than binary names; certutil with -urlcache -split -f indicates download behavior, not certificate management.

Stacking and frequency analysis: count occurrences of a field (parent process, command line, destination port) across the fleet and investigate rare values; rarity is a stronger signal than any single indicator.

Timeline reconstruction: normalize process, network, and authentication events to a single clock source (UTC) and order by time to determine initial execution versus later impact.

Exclusion types: path, file extension, process, hash, and command-line. Prefer hash or certificate-based exclusions over broad path exclusions because paths can be written to by attackers.

Every exclusion is a permanent blind spot; require a business justification, an owner, an expiry/review date, and a compensating control (application control or network segmentation).

Never exclude user-writable directories (temp, downloads, user profiles) or system-wide interpreters wholesale; these are the locations malware uses to bypass scanning.

Tuning sequence: validate the rule logic, check prevalence across the fleet, adjust thresholds or scoping, and only then consider suppression. Suppressing before tuning hides real detections.

Policy precedence: most-specific policy or group assignment wins; document the inheritance order so a test policy does not silently override production settings.

Performance tuning levers: scan concurrency, CPU throttling, archive depth and size limits, and on-write vs on-access scanning. Measure before and after with the same workload.

Change control for policy: stage in a test group, define success metrics (false positive rate, agent CPU, detection coverage), schedule the rollout window, and record a rollback plan.

Exclusion review cadence: quarterly inventory of all exclusions with last-used date; remove exclusions for software no longer installed and re-validate those older than one year.

Core operational metrics: agent coverage percentage (managed devices vs known inventory), definition currency (agents updated within 24-48 hours), policy compliance rate, and detection-to-triage time.

Detection quality metrics: true positive rate, false positive rate per rule, mean time to triage, mean time to contain, and repeat-alert rate for the same rule and host.

Coverage gap analysis compares the endpoint inventory (CMDB, Active Directory, network discovery) against console-managed devices; any unmanaged host is an unreported risk.

SLA definitions: critical alerts triaged within 15-30 minutes, high within 1 hour, medium within 4-8 hours; containment targets should be defined separately from triage targets.

Audit evidence to retain: policy versions with change history, exclusion lists with justification, alert records with disposition, incident reports, and agent deployment logs.

Regulatory mapping: PCI DSS requires anti-malware on all systems and retained logs; HIPAA requires audit controls and integrity protection; ISO 27001 requires documented endpoint controls and review records.

Report audiences differ: executives need coverage and risk trend, operations needs alert volume and SLA adherence, auditors need control evidence and exception approvals.

Backup and continuity: retain console configuration exports and exclusion lists so a console rebuild does not lose policy state; test restoration of reporting data.