Endpoint Security and Endpoint Detection and Response
Telemetry foundations
EDR value comes from depth of collection: process creation with full command line and parent lineage, module and image loads, file writes, registry modifications, network connections tied to a process, script block logging, AMSI content, and DNS queries. On Windows, kernel callbacks and ETW provide visibility that survives user-mode evasion; user-mode API hooking alone can be unhooked. Linux sensors commonly use eBPF, and macOS uses the EndpointSecurity framework. Ask yourself which layer a given event comes from.
Detection logic
- IOC detection (hash, filename, path) is brittle: one byte change or a rename defeats it.
- IOA/behavioral detection targets sequences such as Office spawning PowerShell, credential access against LSASS, or a signed binary proxy executing an unsigned payload. This is what survives repacking.
- LOLBin abuse (certutil, mshta, rundll32, regsvr32) is high-value because the binary is legitimate; context - parent, arguments, user, destination - determines malice.
Response capabilities
Host isolation keeps the agent reachable while blocking network traffic, live response shells allow triage, and triage packages collect memory, autoruns and prefetch. Ransomware rollback restores shadow copies where supported.
Worked example
Alert: rundll32.exe spawned by outlook.exe, loading a DLL from %TEMP%, followed by a connection to a three-day-old domain. Reasoning: the parent-child mismatch is anomalous, the DLL path is user-writable, and the destination lacks reputation history. Correct order: isolate the host, capture memory before any reboot, then hunt the DLL hash and destination domain across the fleet.
Traps that cost marks
- Rebooting or reimaging before capturing volatile memory destroys the best evidence.
- Trusting process names; attackers rename binaries freely.
- Ignoring agent-health and tamper alerts - a disabled sensor is itself a detection.
- Assuming EDR sees payload content inside encrypted C2; it sees the connection metadata, not the plaintext.