Endpoint Detection and Response
Endpoint Detection and Response tests whether you can read process-level telemetry correctly, recognize credential access and defense evasion as they happen, and choose a response action that preserves evidence. Items favor lineage reasoning over signature recall.
Telemetry you must know
- Kernel callbacks and minifilters report process creation, image loads and file writes even when userland hooks are bypassed.
- ETW providers such as Microsoft-Windows-Kernel-Process and the Threat-Intelligence provider supply command lines, .NET assembly loads and memory-scan hits; AMSI exposes script content before execution.
- Sysmon equivalents: Event 1 process create, 3 network connect, 7 image load, 8 CreateRemoteThread, 10 process access, 11 file create, 12/13/14 registry, 22 DNS query.
- Lineage beats names. winword.exe spawning cmd.exe spawning powershell with an encoded command is suspicious regardless of how the binaries are signed; renaming a binary changes nothing in the parent-child graph.
High-value behaviors
LSASS handle opens with GrantedAccess 0x1010, 0x1410 or 0x143a; comsvcs.dll MiniDump; procdump against lsass; service creation (7045) pointing at a user-writable path; scheduled tasks and WMI event subscriptions for persistence; rundll32, regsvr32, mshta, certutil -urlcache and bitsadmin used as download or proxy execution paths; CreateRemoteThread into a signed process. Evasion to expect: direct and indirect syscalls, userland unhooking, bring-your-own-vulnerable-driver, process hollowing, and AMSI patching.
Worked example
An alert shows an unsigned binary in a temp directory opening a handle to lsass.exe with GrantedAccess 0x1410, parented by a Word document process, followed ninety seconds later by outbound TLS to a newly registered domain. Reasoning: the access mask maps to memory read plus limited rights consistent with dumping; the parent is a productivity application that should never touch LSASS; the subsequent connection suggests exfiltration of the dump. Correct sequence: contain the host at the network layer while keeping the sensor channel alive, capture memory, quarantine the binary, then hunt the same parent-child pattern estate-wide.
Traps that cost marks
Detecting on process names instead of hashes and lineage. Missing short-lived processes because of polling intervals rather than event-driven collection. Assuming EDR coverage extends to OT, appliances, containers or legacy servers where no sensor can be installed. Blanket-excluding security tooling directories, which is exactly where attackers stage.