Endpoint Security Fundamentals and Threat Landscape
This domain tests the vocabulary and threat models that justify every endpoint control. Expect questions on attack stages, malware versus non-malware techniques, endpoint telemetry sources, and the difference between indicators and behaviors.
Core rules and concepts
- The attack surface includes user applications, browsers, email clients, removable media, services, drivers, and remote management channels. Endpoint protection must cover execution, persistence, credential access, and lateral movement, not only file scanning.
- Map activity to adversarial phases: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and impact. MITRE ATT&CK is the common reference for these tactics and techniques.
- Detection has three broad engines: signatures (known bad files), reputation (prevalence and trust), and behavior (runtime actions such as Office spawning PowerShell). Signature-only protection misses fileless and living-off-the-land activity.
- Fileless techniques abuse trusted interpreters and OS components: PowerShell, WMI, .NET assemblies, registry-resident payloads, and memory-only implants. Living-off-the-land binaries (LOLBins) such as certutil, rundll32, regsvr32, and mshta are signed and often allowed.
- An indicator of compromise (hash, domain, IP) is perishable and specific. A tactic, technique, or procedure describes behavior and survives indicator changes. Hunt and detect on behaviors where possible.
Worked example
An alert shows winword.exe spawning powershell.exe -nop -w hidden -enc <base64>, followed by an outbound HTTPS connection to a newly registered domain. Reasoning: Office spawning PowerShell is high-risk parent-child behavior; -nop bypasses execution policy, -w hidden hides the window, and -enc obfuscates the command. This maps to user execution, PowerShell abuse, obfuscation, hidden window, and command and control. A benign macro-driven business add-in is possible but uncommon. Isolate the host, collect the process tree, decoded command, network connection, and memory, then search other hosts for the same parent-child pattern and domain. Do not close the alert because the file hash is unknown to the signature engine.
Traps that cost marks
- Treating a vulnerability as an exploit, or calling every malicious file a virus.
- Assuming antivirus signatures alone are sufficient against fileless or LOLBin abuse.
- Confusing a low-prevalence file with a malicious file without behavioral evidence.
- Ignoring parent-child relationships and command-line arguments when judging execution.