OSDA: Endpoint and Network Defense study guide

What the exam tests

This domain tests whether you can read host and network telemetry together and recognize adversary behavior that spans both.

Core rules

On endpoints, process ancestry matters more than process name. winword.exe spawning powershell.exe is abnormal; explorer.exe doing so is routine.
Know the execution and persistence surfaces: Run keys, scheduled tasks, services, WMI subscriptions, DLL side-loading, and signed system binaries such as rundll32, regsvr32, mshta and certutil.
On the network, egress filtering and DNS logging catch beaconing that endpoint tools miss. NetFlow reveals volume and periodicity without needing payload.
Sensor placement determines visibility. An IDS inside the firewall sees lateral movement; one outside sees inbound attempts.
TLS inspection is limited and policy-bound. Use SNI, JA3/JA3S fingerprints, certificate metadata and resolved-domain reputation instead of assuming payload visibility.
Segmentation limits blast radius. Flat networks convert one phished workstation into a domain-wide incident.

Worked example

Chain observed: winword.exe spawns powershell.exe -nop -w hidden -enc <base64>, which opens HTTPS to a newly registered domain at a steady 60-second interval. Reasoning: the parent-child pair indicates macro execution, the encoded and hidden flags conceal the command, and fixed periodicity to a fresh domain indicates command and control. Response: isolate the host, capture memory and the decoded command, block the domain and IP at proxy and DNS, then hunt the same parent-child pair across the estate.

Traps

Relying on antivirus verdicts alone; LOLBin and fileless execution leave no malicious file to sign.
Reading process names without checking parent-child relationships.
Assuming TLS hides all network evidence.
Leaving egress unfiltered so beaconing has somewhere to go.