ETMD EP Practitioners flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Living-off-the-land binary

A signed, legitimate OS tool such as certutil, mshta, or rundll32 abused by attackers to execute payloads or download files while evading signature detection. Verdicts depend on command-line arguments and parent process, not the binary name.

Fileless malware

Malicious code executing in memory via PowerShell, WMI, or .NET assembly loading without writing an executable to disk. Detection relies on script-block logging, module load events, and anomalous process ancestry.

Process ancestry analysis

Examining parent-child process relationships to find suspicious chains, such as an Office application spawning PowerShell or a web server spawning cmd. Legitimate software rarely produces these pairings.

Endpoint telemetry categories

Process creation with command line, network connections with owning process, file create/modify, registry modification, image load, and authentication events. A missing category is a detection blind spot.

Ransomware precursor behaviors

Shadow copy deletion via vssadmin, backup service tampering, and mass file rename typically occur before encryption. These precursors are higher-fidelity alerts than the encryption activity itself.

MITRE ATT&CK tactic order

Enterprise tactics progress from Reconnaissance and Resource Development through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Deployment ring model

A staged rollout sequence: pilot, early adopter at five to ten percent, broad production, then exceptions. Each ring needs a soak period and rollback criterion before the next expands.

Tamper protection

A control preventing local users or malware from disabling real-time scanning, changing exclusions, or uninstalling the agent. It must be enabled before policy tuning, otherwise settings can be silently altered.

Agent health states

Installed but not reporting, reporting with stale policy, protection modules disabled, definitions older than threshold, and pending reboot. Each state indicates a distinct remediation path.

Exploit protection settings

Per-process and system-wide mitigations including ASLR, DEP, control flow guard, and arbitrary code guard. They block exploitation techniques even when the underlying vulnerability is unpatched.

Definition update separation

Signature and engine updates follow a different cadence than policy changes, so a faulty signature can be rolled back without reverting configuration. Both channels need independent monitoring.

Egress requirements for agents

Cloud consoles typically require HTTPS 443 to vendor endpoints plus a defined proxy or PAC file. Missing egress produces agents that install but never report telemetry.

Blocked versus allowed detections

A blocked detection shows prevention worked but execution was attempted; an allowed detection means prevention failed and the host needs immediate isolation. Triage urgency differs sharply.

Alert severity calculation

Severity combines detection confidence, potential impact, and spread risk. A medium-confidence credential-dumping alert on a domain controller outranks a high-confidence adware alert on a workstation.

Network containment

Isolating a host through the console while preserving the agent communication channel. It stops lateral movement but keeps remote investigation and remediation available.

Evidence capture before remediation

Collect process tree, command lines, loaded modules, network connections, persistence locations, and a memory image if the host will be rebuilt. Reimaging first destroys the investigation record.

Incident escalation triggers

Multiple hosts with the same detection, detection on a privileged account or server, evidence of lateral movement, or confirmed data access. Any one converts an alert into a full incident.

Hunt hypothesis structure

State the adversary behavior, the telemetry that reveals it, the expected baseline, and the query. A hypothesis without a baseline cannot distinguish malicious activity from normal operations.

Command-line hunting patterns

Encoded PowerShell flags, download cradles such as IEX or DownloadString, hidden window switches, and long base64 blobs. These argument patterns indicate execution intent regardless of binary name.

Persistence hunt locations

Run and RunOnce registry keys, scheduled tasks, services, WMI event subscriptions, startup folders, and logon scripts. Per-host baselines make unusual additions visible.

Lateral movement indicators

PsExec service creation, remote WMI process creation, admin share SMB access, RDP logon type 10, and pass-the-hash shown as logon type 3 with NTLM across many hosts.

Frequency stacking analysis

Counting occurrences of a field such as parent process or command line across the fleet and investigating rare values. Rarity is a stronger hunting signal than any single indicator.

Timeline reconstruction

Normalizing process, network, and authentication events to UTC and ordering them chronologically. This separates initial execution from later impact during an investigation.

Exclusion type hierarchy

Path, extension, process, hash, and command-line exclusions exist; hash or certificate-based exclusions are safest because attackers cannot write to a hash the way they can write to an excluded path.

Exclusion governance requirements

Every exclusion needs a business justification, an owner, a review or expiry date, and a compensating control such as application control. Each exclusion is a permanent detection blind spot.

Policy tuning sequence

Validate rule logic, check fleet prevalence, adjust thresholds or scoping, and only then consider suppression. Suppressing before tuning hides real detections behind silenced rules.

Policy precedence order

The most specific policy or group assignment wins over broader ones. Documenting inheritance prevents a test policy from silently overriding production settings.

Scan performance levers

Concurrency, CPU throttling, archive depth and size limits, and on-write versus on-access scanning. Measure before and after with the same workload to attribute any change.

Exclusion review cadence

A quarterly inventory listing each exclusion with its last-used date. Remove exclusions for uninstalled software and re-validate any older than one year.

Agent coverage percentage

Managed devices divided by known inventory from CMDB, Active Directory, and network discovery. Any unmanaged host represents risk that never appears in console reporting.

Detection quality metrics

True positive rate, false positive rate per rule, mean time to triage, mean time to contain, and repeat-alert rate for the same rule and host. These measure detection value, not just volume.

Triage and containment SLAs

Critical alerts triaged within fifteen to thirty minutes, high within one hour, medium within four to eight hours. Containment targets are defined separately from triage targets.