← all cheat sheets
FUNDAMENTALS · MECHANISM WALKTHROUGH

Malicious Process to Host Isolation
How EDR Actually Responds

from a phishing macro spawning PowerShell to a fully contained host — behavioral detection, process lineage, and why isolation happens at the endpoint, not the network.
PROCESS LAUNCHES SENSOR CAPTURES CLOUD CORRELATION (IOA) DETECTION FIRES ANALYST TRIAGE NETWORK CONTAINMENT REMEDIATE + RELEASE
01 The Full Sequence — Worked Example
1

Initial Execution

A user opens a phishing attachment. winword.exe runs a malicious macro that spawns powershell.exe with a base64-encoded command — a classic suspicious pattern: an Office application spawning a scripting engine it would never legitimately need.

Execution
2

Kernel-Level Sensor Captures the Event

The EDR sensor — running at the kernel level, always-on — hooks process creation, parent/child relationships, command-line arguments, file writes, and network connection attempts in real time. This happens regardless of internet connectivity; events are queued locally if the endpoint is temporarily offline.

Sensor
3

Telemetry Streamed to the Cloud

The sensor streams this event data up to the vendor's cloud over an encrypted channel in near-real-time. The heavy detection logic mostly lives in the cloud rather than on the endpoint — which is exactly why the local sensor's resource footprint stays small.

Telemetry
4

Cloud Correlation — Behavior, Not Just Signatures

The cloud engine evaluates the event stream against behavioral Indicators of Attack (IOAs) — patterns like "Office app spawns PowerShell with an encoded command" — rather than relying solely on static file-hash Indicators of Compromise (IOCs). This is what catches a payload that has never been seen before anywhere: the behavior is suspicious even if the file itself isn't on any blocklist.

IOA
5

Process Tree / Lineage Built

The cloud maintains a live process ancestry graph for the host: winword.exe → powershell.exe → (outbound connection attempt). This lineage is what lets an analyst see the full story — where the activity originated and what it tried to do next — instead of just a single flagged file in isolation.

Process Tree
6

Checkpoint — Detection Fires

The behavior pattern crosses a severity threshold. A Detection is generated — assigned a severity (e.g. "High"), often mapped to a MITRE ATT&CK technique (e.g. T1059.001, PowerShell) — and appears in the SOC console within seconds of the original event, frequently before any real damage (like a successful C2 callback) has completed.

Checkpoint
7

Automated Prevention vs. Alert Routing

Depending on policy, this simultaneously (a) triggers an automated prevention action — killing the process, quarantining the file — and/or (b) routes the detection to the SOC's queue or SIEM for human triage. Prevention of a single malicious action and full host containment are not the same thing — one can happen without the other.

Alert
8

Analyst Triage

A SOC analyst reviews the process tree, command line, file hash reputation, and any network connections attempted, deciding whether this is a true positive requiring escalation or a false positive (e.g. a legitimate but unusually-written admin script).

Triage
9

Containment Decision

The analyst — or a pre-approved automated response policy for sufficiently high-confidence detections — decides to isolate the host. This is a judgment call balancing "stop any further spread immediately" against "don't disrupt a legitimate business process without solid evidence."

Decision
10

Network Containment Triggered

The analyst clicks "Network Contain" in the console (or an automated policy fires it). A command travels down through the same cloud management channel to the sensor already running on the endpoint — no ticket to the network team, no switchport or firewall change required.

Contain
11

Sensor Enforces Isolation Locally

The kernel-level sensor immediately restricts the host's own network stack to communicate only with the vendor's cloud for continued management and telemetry. Every other network path — including any attempted C2 callback — is blocked at the endpoint itself. This is the key mechanism: isolation happens at the host, not by reconfiguring any network device.

Isolation
12

Investigation Continues Despite Isolation

Because the management channel stays open, the analyst retains full visibility and can still run remote response actions — process listing, file retrieval, memory dump — through the same console, continuing the investigation on a host that is otherwise cut off from the rest of the network.

Forensics
13

Remediation and Release

The analyst kills any remaining malicious process, removes persistence mechanisms, confirms the host is clean, then manually lifts containment. The host returns to normal network access — isolation is deliberately not self-expiring, so a host can't accidentally rejoin the network before it's actually been cleared.

Release
02 How to Explain This in an Interview
03 Follow-Up / Gotcha Questions
Q What's the practical difference between an IOC and an IOA?
A An IOC is a static artifact of a known-bad thing — a file hash, a malicious IP, a specific registry key — and only catches threats that have already been identified elsewhere. An IOA is a behavioral pattern — "this type of process spawned that type of process and then tried to do X" — which can catch genuinely novel malware because it never needed to have been seen before to look suspicious.
Q Why can the EDR sensor isolate a host without any change to switches or firewalls?
A The sensor sits at the kernel level on the endpoint itself and enforces the network restriction locally, in the host's own network stack — it's not asking an external device to block traffic, it's the endpoint refusing to send or accept it in the first place. That's also why it works the same way whether the host is on the corporate LAN, a hotel Wi-Fi, or home broadband.
Q What stops the malware from just killing or disabling the sensor before it can respond?
A Modern EDR sensors run as protected kernel-level drivers with tamper protection specifically designed to resist termination attempts from user-mode processes — including from an account with local admin rights. An attempted tamper typically generates its own high-severity alert rather than succeeding silently.
Q What's the difference between "Detection" and "Prevention" in this workflow?
A A Detection is a flagged, logged event requiring a decision — human or automated — about what to do next. A Prevention is an action the platform already took automatically, like killing a process or blocking a file execution, based on high-confidence policy. A single event can generate both simultaneously: the process gets killed (prevention) while the analyst still reviews the full context (detection/triage).
Q What happens if this occurs while the endpoint is offline?
A The local sensor still enforces cached prevention policies and on-sensor machine-learning/behavioral blocking to some degree without cloud connectivity, but the full cloud correlation, process-tree construction, and remote isolation command can't happen until the host reconnects — at which point queued telemetry uploads and any pending response actions can then take effect.
Q Why not just auto-isolate every host the instant any detection fires?
A False positives happen — an overly aggressive auto-isolation policy on lower-confidence detections would routinely cut off legitimate users and business-critical servers, creating real operational damage on its own. Most SOCs reserve fully automated isolation for only their highest-confidence detection categories and route everything else through analyst triage first.
04 Quick-Fire Glossary
TermMeaning
EDREndpoint Detection and Response — continuous behavioral monitoring, detection, and response tooling for endpoints
IOAIndicator of Attack — a behavioral pattern suggesting malicious activity, independent of any known file signature
IOCIndicator of Compromise — a static artifact (hash, IP, domain) tied to already-known malicious activity
MITRE ATT&CKA standardized framework mapping observed techniques (e.g. T1059.001) to known adversary tactics
Process Tree / LineageThe parent-child ancestry of processes on a host, used to trace an attack back to its origin
Network ContainmentHost-level network isolation enforced by the sensor, leaving only the management channel open
Tamper ProtectionKernel-level defenses preventing the sensor itself from being disabled or uninstalled by malware or a user
C2Command and Control — the channel malware uses to communicate with an attacker-controlled server
SIEMSecurity Information and Event Management — aggregates and correlates alerts from EDR and other sources
Dwell TimeThe elapsed time between initial compromise and detection/containment — a key SOC performance metric