Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) is a security technology that continuously monitors endpoint devices (workstations, servers, mobile devices) to detect, investigate, and respond to advanced threats. Unlike traditional antivirus (AV) which relies on signature-based detection, EDR uses behavioral analysis, machine learning, and threat intelligence to identify suspicious activities that may indicate a breach. EDR systems collect and store telemetry data from endpoints—process creation, network connections, file modifications, registry changes, and user logins—and correlate this data across the enterprise to detect patterns indicative of attacks.

SY0-701 tests the understanding that EDR is not a replacement for AV but a complementary layer. The exam emphasizes that EDR provides visibility into post-exploitation activities, such as lateral movement, privilege escalation, and data exfiltration, which are often missed by AV. EDR solutions typically include a lightweight agent installed on endpoints, a centralized management console, and cloud-based analytics engines.

EDR operates through a continuous cycle of data collection, analysis, detection, and response. Here’s a step-by-step breakdown:

3. Detection Engine: The EDR platform applies multiple detection methods: - Signature-based: Matches known malicious indicators (hashes, IPs, domains) from threat intelligence feeds. - Behavioral: Analyzes sequences of events for suspicious patterns (e.g., a word processor spawning cmd.exe is abnormal). - Machine Learning: Models trained on benign and malicious behaviors flag anomalies. - Threat Intelligence: Compares observed IOCs (Indicators of Compromise) like file hashes, C2 domains, and registry keys against known threat actor TTPs.

5. Investigation and Response: Analysts use the EDR console to investigate alerts. Features include: - Process Tree Visualization: Shows parent-child process relationships to trace the attack chain. - Timeline View: Displays host activity over time, allowing analysts to see what happened before and after an alert. - Live Response: Enables remote execution of commands (e.g., netstat, tasklist, reg query) to gather evidence or remediate. - Isolation: Quarantines the endpoint from the network to prevent spread while preserving forensic data.

Attackers often attempt to disable or evade EDR agents. Common techniques include: - Process Hollowing: Injecting malicious code into a legitimate process to bypass behavioral detection. - Living-off-the-Land Binaries (LoLBins): Using built-in OS tools (e.g., PowerShell, WMIC, certutil) to avoid triggering EDR alerts for unknown executables. - EDR Agent Tampering: Terminating or disabling the EDR service via administrative privileges. Some EDR solutions have self-protection features (e.g., kernel-mode drivers that prevent process termination). - DLL Sideloading: Placing a malicious DLL in the search path of a legitimate application to execute code without spawning a new process.

Defenders deploy EDR with the following best practices: - Phased Rollout: Start with a pilot group to test impact on performance and false positives. - Tuning: Adjust detection sensitivity to reduce noise. Use exclusions for known administrative tools. - Integration: Connect EDR to SIEM (e.g., Splunk, Azure Sentinel) for centralized logging and correlation. Use SOAR for automated response playbooks. - Threat Hunting: Proactively search for IOCs using EDR's query capabilities. For example, search for all hosts where powershell.exe executed within 5 minutes of a suspicious email attachment.

In a Linux environment, the EDR agent may use auditd or eBPF to collect events. A sample audit rule to monitor process execution:

-w /usr/bin/wget -p x -k all

On Windows, EDR agents often leverage Event Tracing for Windows (ETW). An example of a query in Microsoft Defender for Endpoint (KQL):

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, ProcessCommandLine

For response, an analyst might isolate a host using the EDR API:

curl -X POST https://api.edr.com/v1/endpoints/1234/isolation
-H "Authorization: Bearer <token>"
-H "Content-Type: application/json"
-d '{"comment":"Suspicious activity","type":"full"}'

A hospital's EDR (CrowdStrike Falcon) alerts on a workstation in the radiology department showing powershell.exe spawning vssadmin.exe delete shadows /all /quiet. The analyst sees the process tree: outlook.exe -> powershell.exe -> vssadmin.exe. This is classic ransomware precursor behavior—deleting volume shadow copies to prevent recovery. The analyst immediately isolates the host via the EDR console. Using live response, they run netstat -ano and find a connection to an external IP on port 443 (HTTPS). The IP is checked against threat intelligence and found to be a known C2 server. The analyst then uses the EDR's search to find other hosts with similar connections—two more workstations are compromised. The response team blocks the C2 IP at the firewall and runs a ransomare scan on all endpoints. Common mistake: Not isolating quickly enough, allowing the ransomware to encrypt network shares. The correct response is isolation first, then investigation.

A financial firm's EDR (Microsoft Defender for Endpoint) alerts on an employee's workstation: rundll32.exe executing with a command line containing javascript:—a technique used to download payloads. The employee is a senior accountant with access to sensitive financial data. The analyst reviews the timeline: the user visited a personal email and clicked a link. The EDR shows that after the rundll32 execution, a file named invoice.pdf.exe was downloaded and executed. The analyst uses live response to collect the file and sends it to a sandbox, which confirms it's a keylogger. The analyst isolates the host and interviews the user, who admits to clicking a phishing link. The EDR's user behavior analytics (UBA) also flagged the user for accessing 50+ customer records in the past hour—a deviation from normal. The incident is escalated to HR. Common mistake: Assuming the alert is a false positive because the user is trusted. EDR's behavioral detection is designed to catch compromised trusted accounts.

A retail chain's EDR (SentinelOne) detects a suspicious logon event: an administrative account logged into a point-of-sale (POS) system from a workstation in the back office. The EDR correlates this with a previous alert—the workstation had executed mimikatz.exe (a credential dumping tool). The analyst uses the EDR's graph view to see that the same account then logged into three other POS systems. This is lateral movement using pass-the-hash. The analyst isolates all affected POS systems and resets the compromised account's password. The EDR's automated response kills the mimikatz process and blocks the account from further logons. Common mistake: Only remediating the initial workstation without checking for lateral movement. EDR's correlation across endpoints is essential to find the full scope.