XDR Analyst cheat sheet

XDR correlates telemetry across endpoint, network, identity, email, and cloud into a single detection and response layer; it is not a single sensor but a fusion of sources with a common data model.

Core pipeline stages in order: collection and normalization (schema mapping to a common field model), enrichment (asset, identity, threat intel context), detection (rules, analytics, ML), correlation into incidents, then response actions.

Endpoint detection and response (EDR) is a subset: XDR must ingest at least one non-endpoint source (identity, email, network, or cloud) to qualify as cross-domain.

Normalization schemas commonly align to ECS (Elastic Common Schema) or OCSF (Open Cybersecurity Schema Framework); field-name drift across vendors is the most common cause of broken detections.

Detection logic tiers: signature/IOC matching (high precision, low durability), behavioral analytics (process lineage, anomaly baselines), and correlation rules that join events across sources by shared entities (host, user, IP, hash).

Entity resolution maps raw identifiers to canonical assets and identities; unresolved entities cause incident fragmentation, where one intrusion appears as many low-severity alerts.

Data retention tiers: hot (searchable, days to weeks), warm (weeks to months), cold/archive (months to a year or more); detection windows are bounded by the shortest retention of any required source.

Agent coverage and telemetry health are first-class metrics: percentage of enrolled endpoints reporting in the last 24 hours, sources with ingestion gaps, and parsers failing to map fields.

Process lineage is the primary detection primitive: parent-child relationships (e.g., Office spawning PowerShell, wmiprvse spawning cmd) reveal execution chains that single-event rules miss.

Key Windows event sources: Sysmon Event ID 1 (process create), 3 (network connect), 7 (image load), 8 (CreateRemoteThread), 10 (process access), 11 (file create), 22 (DNS query); Security 4688 (process create), 4624/4625 (logon success/failure).

Linux telemetry centers on auditd/execve, eBPF process and network events, and /proc-derived context; macOS on EndpointSecurity framework events (ES_EVENT_TYPE_AUTH_EXEC, NOTIFY_WRITE).

Living-off-the-land binaries (LOLBins) - certutil, bitsadmin, mshta, rundll32, regsvr32, wmic - are legitimate signed tools abused for download, execution, or persistence; detection depends on command-line arguments, not binary reputation.

Credential access indicators: LSASS handle access with read rights (Sysmon EID 10 targeting lsass.exe), comsvcs.dll MiniDump usage, and ntds.dit extraction via esentutl or vssadmin shadow copies.

Persistence surfaces to baseline: Run/RunOnce keys, scheduled tasks, services, WMI event subscriptions, startup folders, and launch agents/daemons on macOS.

Memory protection changes (VirtualAlloc RWX, WriteProcessMemory, CreateRemoteThread) plus unsigned image loads into unusual processes indicate injection; correlate with network egress from the same process.

Isolation (network containment) preserves the agent connection while blocking most traffic; it is reversible and preferred over host shutdown, which destroys volatile evidence.

Proxy and DNS logs answer who talked to what: fields to pivot on are source IP/internal asset, destination FQDN, resolved IP, URI, user agent, bytes in/out, and HTTP method/status.

Beaconing detection looks for low-jitter or fixed-interval connections to the same destination with consistent payload sizes; compute inter-arrival time variance - low variance over many connections is suspicious.

DNS tunneling indicators: high volume of TXT/NULL queries, long encoded subdomains, high entropy labels, and a single authoritative domain with many unique subdomains.

East-west (lateral) traffic matters more than perimeter egress in mature environments: SMB (445), RDP (3389), WinRM (5985/5986), and Kerberos (88) between workstations are anomalies.

Cloud control-plane logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) record API calls; high-value events are CreateAccessKey, AttachUserPolicy, ConsoleLogin without MFA, and StopLogging/DeleteTrail.

Cloud data-plane logs (S3 access logs, VPC Flow Logs, Azure NSG flow logs) show actual data access; correlate control-plane identity changes with subsequent data-plane reads for exfiltration patterns.

VPC/NSG flow logs are 5-tuple records with accept/reject disposition and byte/packet counts; they lack payload, so pair with DNS and proxy logs for context.

NetFlow/IPFIX sampling (commonly 1:1000 to 1:100) means volume thresholds must be scaled; absence of a flow is not proof of no traffic under sampling.

Authentication log fields to pivot on: user principal, source IP/ASN, geo, user agent, auth method (password, MFA push, token), result code, and session/device ID.

Impossible travel is computed from consecutive successful authentications whose implied velocity exceeds physical travel; false positives arise from VPN egress, mobile carrier NAT, and cloud proxies.

MFA fatigue/push bombing: repeated push prompts followed by an approval; detection joins many denied MFA events to a later success from the same user and source.

Token theft bypasses MFA entirely: look for anomalous refresh-token use, new device registrations, and mailbox rule creation shortly after a suspicious sign-in.

Email authentication chain: SPF checks envelope sender against authorized IPs, DKIM verifies a cryptographic signature over headers/body, DMARC aligns SPF or DKIM with the From domain and applies policy (none/quarantine/reject).

Business email compromise indicators: lookalike or newly registered sending domains, reply-to mismatch with From, first-contact external sender, urgency language, and thread hijacking (Re: subject with no prior message).

Phishing payload delivery signals: HTML attachments with credential forms, QR codes bypassing URL scanners, cloud file-sharing links (SharePoint/Drive) with restricted access, and link redirects through URL shorteners.

Mailbox persistence: inbox forwarding rules, delegate access grants, and OAuth application consent grants survive password resets and must be enumerated during containment.

Intelligence pyramid: hash and IP indicators are cheap and short-lived; TTPs (behaviors) are expensive to change and therefore most durable for detection.

Indicator confidence decays: attach a TTL to IOCs and re-validate before use; stale IP/domain indicators produce false positives as infrastructure is repurposed.

Frameworks: MITRE ATT&CK (tactics/techniques, adversarial behavior), MITRE D3FEND (countermeasures), and the Cyber Kill Chain (sequential stages) - map every detection to at least one ATT&CK technique.

Hunting loop: form a hypothesis from intel or a gap, define required data sources, query, triage results, then convert confirmed findings into automated detections.

Query patterns: stack counting (group by rare parent-child pairs), frequency analysis (rare command lines), and statistical baselines (z-score or MAD on per-user event counts).

Sigma is a vendor-neutral detection rule format that compiles to SIEM query languages; it enables portable, reviewable detection-as-code.

False positive control: whitelist by entity plus behavior, not by binary hash alone; suppression rules must carry an owner and expiry to prevent detection rot.

Purple teaming validates detection coverage by executing known techniques (Atomic Red Team, CALDERA) and measuring which detections fire - coverage gaps are the output.

Severity is a function of asset criticality, identity privilege, detection confidence, and blast radius - not alert source alone; a low-confidence alert on a domain controller outranks a high-confidence alert on a lab VM.

Triage order: validate the alert is real, scope affected entities (hosts, users, accounts), determine dwell time, then contain.

Containment options ranked by reversibility: identity session revocation and password reset, endpoint network isolation, account disable, then host reimage.

Evidence handling: capture volatile data (memory, running processes, network connections) before shutdown; preserve chain of custody with hashes and timestamps.

Automation playbook (SOAR) building blocks: enrichment lookups, entity extraction, conditional branching, approval gates for destructive actions, and ticket/chat notification.

Automation guardrails: allow-list only reversible actions (isolate host, disable user, block hash) for automatic execution; require human approval for deletion, reimage, or mass actions.

Mean time to detect (MTTD) and mean time to respond (MTTR) are the core response metrics; track them per detection rule to find noisy or slow detections.

Post-incident: root cause, detection gap analysis, new detection rules, and lessons-learned documentation; close the loop by updating the threat model and playbooks.