EDR and Host-Based Analysis
EDR and Host-Based Analysis tests endpoint investigation: reconstructing process execution, identifying persistence, and using host telemetry to confirm or refute a network alert.
Core rules
- Build process trees, not process lists. The parent-child relationship and command line matter more than an image name. Sysmon Event ID 1 (process creation) with ParentImage, CommandLine, and Hashes is core evidence.
- Know common Sysmon events: 3 network connection, 7 image load, 8 CreateRemoteThread, 10 process access, 11 file create, 12/13/14 registry, 22 DNS query.
- Watch LOLBins: powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, wmic.exe. Their presence is not malicious; their arguments and parent are.
- Check persistence locations: Run keys, scheduled tasks, services, WMI subscriptions, and startup folders.
Worked example
Sysmon shows WINWORD.EXE spawning powershell.exe with -enc and a Base64 blob, followed by a network connection to an external IP. Reasoning: Office does not normally spawn PowerShell; the encoded command hides intent, and the outbound connection suggests stage-two retrieval. Decode the blob, hash the child process, and search fleet-wide for the same parent-child pair.
Traps
- Trusting a signed binary or familiar name without checking path and parent.
- Ignoring command-line arguments and encoded content.
- Treating a single EDR alert as the full scope.
- Missing registry and scheduled-task persistence because you only reviewed processes.
- Overlooking user context, which can reveal credential misuse.