Scope note: this is a defender-side operational reference — concepts, telemetry, and query patterns are generalized across major EDR platforms (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, VMware Carbon Black, Sophos Intercept X). Exact field/table names differ per vendor and change between console versions — items marked VERIFY are worth confirming in your specific console before relying on them. Attacker-technique sections describe what EDR watches for, for detection-engineering purposes, not step-by-step offensive instructions.
SENSOR · endpoint telemetry
detect
CONSOLE · triage / investigate
respond
SOC · contain / hunt / tune
01 What EDR Actually Does
👁
Continuous Visibility
Every endpoint runs a lightweight sensor streaming process, network, file, and registry telemetry to a cloud/on-prem console — recorded continuously, not just at scan time.
🧠
Behavioral Detection
Detects by behavior pattern (a process injecting into lsass.exe, then opening a network socket) rather than only matching known-bad file signatures — catches novel/fileless malware that signature AV misses.
🔍
Investigation Tooling
Process trees, timelines, and cross-endpoint pivoting let an analyst reconstruct what happened before, during, and after an alert — not just "file X was blocked."
🛑
Response Actions
Isolate a host, kill a process, quarantine a file, or drop into a remote shell — all from the console, without physically touching the endpoint.
🕵
Threat Hunting
Retained historical telemetry lets an analyst query retrospectively — "has any endpoint run this command line in the last 30 days" — even for activity that triggered no alert at the time.
🔗
Threat Intel Enrichment
File hashes, IPs, and domains seen on the endpoint are auto-checked against the vendor's threat intel feed, adding reputation context to every event without manual lookup.
02 EDR vs AV vs XDR vs MDR
Term
What It Is
Key Limitation / Note
AV (Antivirus)
Signature/heuristic scanning that blocks known-bad files pre-execution
Little visibility once something evades the initial scan — no timeline, no investigation tooling
KQL (Advanced Hunting, via M365 Defender / Sentinel)
Deep native integration with Windows, Entra ID (Azure AD), and the rest of the Microsoft security stack
SentinelOne Singularity
Deep Visibility query language (SQL-like)
Autonomous AI-driven detection; one-click ransomware rollback via retained snapshots
VMware Carbon Black Cloud
CB query syntax (Lucene-like)
Watchlists and IOC feeds layered on top of a reputation-driven EDR core
Sophos Intercept X
Live Discover (osquery-based SQL)
Uses the open-source osquery engine under the hood for its query/hunting layer
VERIFY — query language syntax and feature names shift across vendor console versions; confirm against your tenant's current documentation before building hunt queries for production use.
04 Core Telemetry Sources
⚙
Process Events
Creation/termination, full command line, and parent-child lineage — the single most useful signal; almost every investigation starts by walking the process tree.
🌐
Network Connections
Process-to-socket mapping (which process opened which remote IP:port), plus DNS query telemetry — ties network activity back to the process that caused it.
📁
File System Events
Create/modify/delete/rename, with extra weight on writes to sensitive paths (startup folders, system directories).
🗝
Registry Modifications
Windows-specific — persistence keys (Run/RunOnce), service configuration, and security-relevant policy keys are the highest-value subset to alert on.
🧩
Module/DLL Loads
Flags unsigned or unusually-located DLLs loading into a trusted process — a core signal for detecting injection and DLL sideloading.
🔑
Authentication Events
Logon type (interactive, RDP, service, network), success/failure, and source — correlated with process activity to catch lateral movement.
05 IOC vs IOA
📌
IOC — Indicator of Compromise
A static artifact: a file hash, an IP, a domain, a registry path. Reactive by nature — trivial for an attacker to evade by changing the artifact (recompiling a hash, rotating C2 infrastructure).
🎯
IOA — Indicator of Attack
A behavioral pattern: "a process opened a handle to lsass.exe with read memory access, then made an outbound connection." Detects the technique regardless of the specific tool used — this is what modern EDR behavioral engines are actually built around.
06 MITRE ATT&CK Quick Map (Enterprise)
Tactic
Example Technique EDR Would Flag
Initial Access
Phishing attachment spawning a child process from Outlook/Word
Execution
PowerShell with an encoded (-enc) command line
Persistence
New Run key, scheduled task, or WMI event subscription
Privilege Escalation
Token manipulation or exploitation of a local service running as SYSTEM
Defense Evasion
Unsigned DLL sideloaded into a trusted, signed process
Credential Access
Unusual read-memory handle opened to lsass.exe
Discovery
Rapid sequence of whoami, net group, nltest commands
Lateral Movement
PsExec/WMI/RDP session immediately followed by process creation on the target
Collection
Bulk archive creation (zip/rar) of sensitive file-share paths
Command and Control
Beaconing pattern — regular-interval outbound connections to a low-reputation domain
Exfiltration
Large outbound transfer immediately following a collection/archive event
Impact
Mass file modification/rename consistent with ransomware encryption
07 Investigation Workflow
1
Triage the Alert
Read the detection name/technique mapping first — it tells you what behavior triggered it before you touch raw telemetry.
2
Walk the Process Tree
Identify the parent chain up to a known-legitimate root (or up to the point it stops making sense) — an unexpected parent (e.g. winword.exe → powershell.exe) is often the whole story.
3
Pivot on Network Activity
Check what the flagged process connected to — reputation-check the remote IP/domain, and look for a beaconing (regular interval) pattern.
4
Check File/Hash Reputation
Cross-reference the binary's hash against the vendor's threat intel and, if allowed by policy, a multi-engine lookup — but treat "unknown" as neutral, not benign.
5
Reconstruct the Timeline
Pull every event on the host in the window around the alert — most consoles offer a unified timeline view rather than making you stitch process/network/file logs manually.
6
Check for Lateral Spread
Search the same IOC/IOA fleet-wide before closing the case — a single-host view can miss that the same actor already touched three other machines.
08 Query Language Cookbook
MS
KQL — Suspicious PowerShell
DeviceProcessEvents
| where FileName in~ ("powershell.exe","powershell_ise.exe")
| where ProcessCommandLine has_any ("-enc","-EncodedCommand"," -e ")
MS
KQL — LSASS Access
DeviceEvents
| where ActionType == "ProcessAccess"
| where RemoteProcessName =~ "lsass.exe"
MS
KQL — New Scheduled Task
DeviceProcessEvents
| where FileName == "schtasks.exe"
| where ProcessCommandLine has "/create"
SELECT pid, name, path, on_disk
FROM processes
WHERE on_disk = 0;
on_disk = 0 flags a running process whose backing binary is no longer on disk — a strong fileless/deleted-payload signal.
SQ
osquery — Listening Ports
SELECT pid, port, address
FROM listening_ports
WHERE port = 4444;
◈
Sigma Rules
A vendor-agnostic YAML detection format — write once, translate to KQL/SPL/EQL/FQL with tools like sigma-cli or Uncoder. Useful for porting community detection content into whichever platform you're on.
🔎
General Hunt Pattern
Most useful hunts follow the same shape: filter by known-LOLBin filename → filter command line for suspicious flags/args → check parent process → check what happened next. The specific syntax changes; the pattern doesn't.
09 Common Attacker Techniques EDR Watches For
🧰
LOLBins (Living-off-the-Land)
Legitimate, signed OS binaries (certutil.exe, bitsadmin.exe, mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe) abused to download or execute payloads — evades naive allow-listing because the binary itself is trusted.
💉
Process Injection
Reflective DLL injection, process hollowing, APC injection — malicious code executes inside a legitimate process's memory space to blend in with normal activity and inherit its trust/permissions.
🔓
Credential Dumping
Unusual read-memory handles opened to lsass.exe (Mimikatz-style), SAM/SECURITY hive access, or DCSync-style domain controller replication requests from a non-DC host.
📌
Persistence Mechanisms
Run/RunOnce registry keys, new scheduled tasks, WMI event subscriptions, new services, startup-folder drops, and shell profile hijacking — the fleet-wide "what changed to survive a reboot" question.
🫥
EDR-Aware Evasion (defender awareness)
Attackers increasingly target the EDR sensor itself — patching userland API hooks, disabling ETW providers, or using direct syscalls to bypass hooked ntdll functions. This is why modern EDR leans on kernel-level and ETW-TI telemetry rather than userland hooks alone.
⚠ described here for detection-engineering awareness only — not a how-to; if your role needs the offensive detail, that belongs in a controlled red-team/purple-team exercise, not a reference sheet
🔒
Ransomware Precursors
Shadow copy deletion (vssadmin delete shadows), disabling of recovery options, and mass file rename/encryption activity — catching the precursor commands buys minutes that matter before encryption starts.
10 Response Actions
🔌
Network Isolation
Cuts the host off from the network except the EDR console's own management channel — typically the first action on a confirmed compromise to stop lateral movement/exfiltration.
⚠ disruptive — confirm scope before isolating a production/critical host, and have an out-of-band comms channel ready since RDP/console access is usually cut too
✕
Kill Process
Terminates a specific running process by PID across one or more hosts, without a full isolation.
🗄
Quarantine File
Moves the file into the vendor's encrypted quarantine store — reversible, unlike deletion, if it turns out to be a false positive.
💻
Remote Shell / Live Response
Console-driven remote command execution (CrowdStrike Real Time Response, Defender Live Response) — run commands, pull files, or capture a memory image without physical/RDP access.
🚫
Fleet-Wide Hash Block
Adds a custom IOC to block a specific file hash across every managed endpoint — used once a malicious sample is confirmed, to pre-empt spread before full remediation.
↺
Rollback (where supported)
Some platforms (notably SentinelOne) can restore encrypted/modified files from a retained snapshot — a ransomware-specific recovery action, not a general-purpose undo.
11 Alert Triage & Tuning
🎚
Severity Tiers
Informational → Low → Medium → High → Critical, typically mapped to a response SLA (e.g. Critical = page on-call immediately, Informational = weekly review batch).
✂
Exclusion Discipline
Tune false positives by exact hash, file path, or publisher certificate — never by disabling an entire detection rule fleet-wide just to quiet one noisy app.
📅
Exclusion Expiry
✓ document every exclusion with an owner and a review/expiry date — undocumented exclusions are exactly where real incidents hide later
12 Common Errors & Troubleshooting
Symptom
Likely Cause / Fix
Agent shows offline in console
check sensor service is running, cloud connectivity/proxy config, and any tamper-protection conflicts
High CPU/disk usage from the agent
add path/process exclusions for known-heavy legitimate apps (backup software, build tools) and confirm no second real-time AV is running
Detection fired but the process is already gone
pull memory/timeline via live response immediately — transient/fileless payloads disappear fast
Isolated host still reachable via RDP
check the vendor's isolation exception list — some allow specific channels through by design
Hunt query returns nothing despite known activity
telemetry retention window exceeded, or the schema/table name changed between console versions
Two AV/EDR agents flagging each other
running two real-time engines simultaneously causes performance issues and cross-detection false positives — uninstall the redundant one
Action
Risk
Isolating a production/critical host
caution confirm scope and have an out-of-band comms path first
Disabling a detection rule fleet-wide
risky exclude by hash/path/publisher instead of killing the whole rule
Deleting (vs quarantining) a suspicious file
caution not reversible if it turns out to be a false positive or evidence you'll need later
Fleet-wide hash block on an unconfirmed sample
caution can break legitimate software if the hash match is broader than expected
Read-only hunt queries
safe non-disruptive, the default first move for any investigation
Running two real-time AV/EDR engines together
unstable performance conflicts and unreliable detection — avoid outright