Endpoint Security

AV Detection:
  └─ Hash matching: Does the file hash match a known malware hash?
  └─ Signature matching: Does the file byte sequence match a known pattern?
  └─ Limitation: A 1-byte change to the file bypasses hash-based detection

EDR Detection:
  └─ Process ancestry: Is PowerShell spawning from Word normal?
  └─ Behavioural patterns: Is a process accessing LSASS memory?
  └─ Chain analysis: Are several LOW-severity events forming a HIGH-severity attack chain?
  └─ Machine learning: Does this behaviour deviate from the endpoint's baseline?

Common Persistence Detections:
  └─ Registry Run keys: New or modified HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  └─ Scheduled tasks: Task created by non-admin user pointing to unusual binary
  └─ Startup folder: .lnk or .vbs file added to Startup folder
  └─ WMI persistence: WMI event subscription to run on system start
  └─ DLL search order hijacking: DLL planted in a path searched before the legitimate one
  └─ Service creation: New service with path to %TEMP% or non-standard directory

Common Privilege Escalation Detections:
  └─ Token manipulation: SeDebugPrivilege enabled on non-admin process
  └─ UAC bypass: Event ID 4907 (audit policy change) followed by silent process creation
  └─ DLL sideloading: Legitimate EXE loads DLL from attacker-controlled path
  └─ Named pipe impersonation: Pipe creation followed by privileged process connection
  └─ Exploit: Known vulnerable driver loaded (CVE-2021-1675, CVE-2022-21894)

Defense Evasion Detections:
  └─ Process injection: CreateRemoteThread, QueueUserAPC, SetThreadContext calls
  └─ AMSI bypass: PowerShell attempting to patch or disable AMSI
  └─ Disabling security tools: Stop-Service, killing EDR/AV processes
  └─ Binary padding: Executable padded to exceed typical size threshold
  └─ Signed binary abuse: Sigcheck bypass using revoked-but-signed binaries (LOLDrivers)
  └─ Obfuscation: Base64-encoded commands, multiple encoding layers

Credential Access Detections:
  └─ LSASS dump: Procdump, Task Manager, or custom tool reading lsass.exe memory
  └─ SAM registry hive access: reg save hklm\sam
  └─ Kerberos ticket theft: Using Mimikatz sekurlsa::tickets
  └─ Credential manager access: vaultcmd /list credentials
  └─ NTDS.dit access: Volume Shadow Copy + ntdsutil
  └─ Keylogging: SetWindowsHookEx for keyboard/mouse input

Detection: "Process Rollup with SMB Write to Admin Share"
Severity: Critical
Technique: Lateral Movement (PsExec-like behaviour)

Indicators:
  └─ Process: services.exe created svchost.exe → cmd.exe
  └─ Network: SMB write to ADMIN$ share on remote host 10.0.2.50
  └─ File: PSEXESVC.exe written to \\10.0.2.50\ADMIN$\
  └─ Registry: Service created: PSEXESVC on remote host

Suggested Actions:
  └─ Contain the source host immediately
  └─ Check if lateral movement succeeded → check remote host for access
  └─ Review RDP/network logs for source of initial compromise
  └─ Escalate to incident response

Alert: "Suspicious PowerShell command line"
Severity: High
Category: Execution

Attack chain:
  └─ User opened malicious email attachment (Word document)
  └─ Word spawned PowerShell with obfuscated command
  └─ PowerShell downloaded and executed Cobalt Strike beacon
  └─ Beacon established HTTPS connection to 185.xxx.xxx (malicious IP)

Hunting KQL:
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc"
| summarize count() by DeviceName, InitiatingProcessCommandLine
| order by count_ desc

Endpoint (EDR) ←→ Network (NDR) ←→ Email ←→ Cloud ←→ Identity
                        ↓
                   XDR Platform
                        ↓
            Cross-Domain Detection Rules
            Unified Alerting
            Automated Response

Deployment Considerations:

Phased Rollout:
  └─ Phase 1: Pilot on 5-10% of endpoints (IT team + security team workstations)
  └─ Phase 2: Roll out to internet-facing servers and critical workstations
  └─ Phase 3: All endpoints (servers, workstations, laptops) — 90% within 30 days
  └─ Phase 4: Exceptions (legacy systems, air-gapped, specialised equipment)

Performance Testing:
  └─ CPU baseline before/after installation (expect 1-5% CPU usage)
  └─ Boot time impact (expect 0-5 second increase)
  └─ Application compatibility (test with critical business applications)
  └─ Network throughput impact (negligible for agent-based EDR)

Exclusions:
  └─ Microsoft Defender + CrowdStrike: Add mutual exclusions
  └─ High-volume database servers: Exclude specific database temp directories
  └─ Development tools: Exclude compilers, debuggers from real-time scanning
  └─ Backup software: Ensure backup processes are not blocked