Endpoint threats and EDR

What is EDR?

Endpoint Detection and Response (EDR) monitors activity on devices to help detect, investigate and respond to threats. Response actions can include isolating a device, stopping a malicious process or quarantining a file.

Traditional antivirus mainly detects known malware using signatures. Modern antivirus also uses other methods, including behavioural detection.

EDR gives analysts more visibility into activity such as processes, commands and network connections. This helps them investigate how suspicious activity started, what happened and how to respond.

Programs, processes and scripts

A program is software stored on a system. A process is a running instance of a program. A script contains instructions that an interpreter, such as PowerShell, can execute.

A PowerShell script usually runs within a PowerShell process. Looking at that process’s parent, command line and child processes helps explain how the script started and what it did.

Behaviours worth understanding

These behaviours can help explain an endpoint alert. Context is still necessary when deciding whether they are malicious.

Credential access

Attempts to obtain passwords, hashes or tokens. LSASS is a Windows process involved in authentication; attackers may attempt to extract credential-related data from its memory. The SAM database stores local Windows account information, including password hashes.

Process injection

Placing code into another process. Analysts investigate the source, target and surrounding execution activity.

Suspicious PowerShell

Commands that download content, execute unusual scripts or use obfuscation. PowerShell is also a legitimate administration tool.

Recovery interference

Deleting Volume Shadow Copy backups can be part of ransomware activity because it makes recovery harder.

Encoding is not encryption

Base64 represents data in a different text format. It can make a command less immediately readable, but it does not make the contents secret.

An encoded command can be legitimate. The important step is to understand what it does after decoding and how it relates to the rest of the activity.

Why “blocked” is not the end of the investigation

Consider a low-severity PowerShell enumeration alert on a domain controller. Even if the command was blocked, there is another question: how was someone able to execute it on that server?

If the expected administrator did not run it and there is no authorised explanation, the activity may indicate an earlier access problem. The immediate command and the wider compromise are different things to investigate.

Indicators and detection blind spots

Indicators of Compromise (IOCs) are clues that may point to a compromised system, such as known malicious file hashes, IP addresses or domains.

A file hash helps identify a particular file. Even a small change to the file can produce a different hash, so analysts also need to consider its behaviour and the surrounding activity.

Security tools do not detect everything. No alert does not mean no attack occurred. Searching the available logs for related processes, logins and network connections can help uncover activity that did not trigger an alert.