Endpoint and System Security
This domain tests hardening and detection on hosts: baselines, patching, application control, the difference between endpoint protection platforms and EDR, encryption of data at rest, and the secure boot and TPM chain that underpins it.
Core rules and concepts
- Hardening baseline: remove unnecessary services, disable or rename default accounts, enforce least functionality, apply CIS Benchmarks or vendor STIGs, and measure configuration drift.
- Patch management: inventory, risk-rank, test, deploy, verify, with an emergency path for actively exploited vulnerabilities.
- Application allowlisting (default deny) is stronger than blocklisting, which only stops known-bad binaries.
- EPP is the prevention stack (antivirus, HIPS, host firewall, device control). EDR adds continuous telemetry, behavioural analytics, investigation and response. XDR correlates across endpoint, identity, email and cloud.
- Secure boot plus measured boot plus a TPM seal the boot chain and protect disk-encryption keys. Full-disk encryption protects data at rest only, not a running authenticated session.
- Host firewalls, log forwarding of process telemetry to the SIEM, and USB device control reduce local attack surface.
- MDM/UEM enforces configuration and compliance for managed endpoints; BYOD needs containerisation and conditional access.
- Host attack patterns: fileless and LOLBin abuse, credential dumping, ransomware deleting shadow copies before mass encryption, living-off-the-land persistence.
Worked example
A workstation begins encrypting files and contacts an unknown domain. EDR flags mass file modification plus shadow copy deletion, behaviour mapping to the Impact tactic and the Inhibit System Recovery technique. Response: isolate the host from the network through the EDR agent (containment), capture memory and the EDR process timeline before reimaging (evidence), revoke the user's sessions and tokens, then hunt the same hash and parent process across the estate using existing telemetry. Rebuild from a known-good image rather than cleaning in place; root cause decides whether patch, configuration or credential reset closes the gap.
Traps that cost marks
- Treating signature antivirus as equivalent to EDR.
- Cleaning malware in place and destroying forensic evidence.
- Claiming disk encryption stops theft of data from a logged-in session.
- Confusing allowlisting with application-aware firewalling, or patching with mitigating.