Group 08: Endpoint Security and Malware

What is EDR?

Endpoint Detection and Response provides endpoint telemetry, behavioral detection, investigation, and response capabilities.

What is the difference between EDR and traditional antivirus?

Antivirus primarily detects known or suspicious malware, while EDR provides broader behavioral visibility, investigation data, and response actions.

What is malware?

Software intentionally designed to damage, disrupt, spy on, or gain unauthorized access to systems.

What is ransomware?

Malware that encrypts or disrupts systems and demands payment.

What is a Trojan?

Malicious software disguised as legitimate software or content.

What is a worm?

Malware capable of spreading automatically between systems.

What is spyware?

Malware designed to secretly collect information about users or systems.

What is a process tree?

A representation of parent and child process relationships showing how programs were started.

Why are parent-child process relationships important?

Unusual relationships may reveal malicious execution, scripting, exploitation, or abuse of trusted tools.

What is a LOLBin?

A legitimate operating-system binary abused by attackers for malicious activity.

What is credential dumping?

Extracting passwords, hashes, tickets, tokens, or other authentication material from a system.

What is process injection?

Running malicious code inside another process to evade detection or use its privileges.

What is persistence?

A technique used to maintain access after restarts, logouts, or credential changes.

What is command and control?

Communication between an attacker and compromised systems for issuing commands or transferring information.

What is endpoint isolation?

Restricting a device’s network communication while preserving access needed for security investigation and response.

What is quarantine?

Isolating a suspicious or malicious file so it cannot execute or affect the system.

Why can PowerShell be suspicious?

Attackers may use it to execute scripts, download payloads, collect information, evade controls, or move laterally.

Why can rundll32.exe be suspicious?

Attackers may abuse it to execute malicious DLL functions or proxy malicious execution.

Why can certutil.exe be suspicious?

It can download, decode, or manipulate files in addition to its legitimate certificate functions.

Why can mshta.exe be suspicious?

It can execute HTML applications and scripts, including malicious remote content.

Why can regsvr32.exe be suspicious?

It may be abused to execute scripts or DLLs while using a trusted Windows binary.

Why can schtasks.exe be suspicious?

It can create scheduled tasks for persistence or execution.

Why can sc.exe be suspicious?

It can create, modify, and start Windows services for persistence or execution.

What should be reviewed when a legitimate Windows tool triggers an alert?

Review the user, command line, parent process, child processes, file path, signature, network activity, timing, and business context.

Why should a remediated malware alert still be investigated?

The malware may have executed, spread, stolen credentials, established persistence, or affected other systems before remediatio