Examkin

Question

Difficulty: Very hardEndpoint Detection and Response (EDR)

During an incident investigation on a critical Linux application server, system administrators report that an attacker executed a fileless payload by injecting malicious code directly into the memory space of a legitimate running daemon. To hide their tracks, the attacker wiped the local bash history, deleted event logs from disk, and terminated the interactive shell session. Despite these anti-forensic measures, the Endpoint Detection and Response (EDR) agent successfully captured the complete process lineage, parent-child relationships, and exact memory allocation calls. Which of the following capabilities enabled the EDR agent to maintain continuous behavioral visibility in this scenario?

  1. Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shellsAnswer
  2. B
    Signature-based antivirus file scanning configured to perform real-time disk sanitization upon detecting unverified process memory allocations
  3. C
    Perimeter network firewall inspection that decrypts ingress NetFlow sessions and maps host sockets to network segment policies
  4. D
    Automated host vulnerability scanning that audits daemon configuration baselines and local file permissions against standard benchmarks

Answer

Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shells
The correct response highlights kernel-level event hooking and sensor callbacks. Modern EDR solutions install lightweight sensors that integrate deeply with the operating system kernel. These sensors capture execution events, thread creation, memory allocations, and process tree relationships in real time as they occur in memory. Because telemetry is transmitted continuously to an isolated monitoring collector, local anti-forensic actions—such as clearing bash histories or deleting log files from disk—have no effect on the agent's recorded process history.

Step-by-Step Solution

1
Analyze the attack techniques and anti-forensic steps in the scenario.
The attack involves fileless execution (in-memory code injection into a daemon process) accompanied by anti-forensic techniques (wiping local bash history and disk logs).
Identifying the nature of the attack reveals why traditional disk-based or log-file-dependent controls fail.
2
Evaluate how Endpoint Detection and Response (EDR) captures telemetry during fileless execution.
EDR agents operate sensor drivers at the operating system kernel level (e.g., eBPF in Linux, OS kernel callbacks) to continuously observe process calls, API hooks, and memory allocations in real time.
Kernel hooks sit below user-space applications and disk storage, ensuring telemetry stream generation cannot be disabled or erased by user-space log wiping.
3
Select the choice that correctly describes this EDR mechanism.
Kernel-level system event hooking provides real-time, independent telemetry capture unaffected by disk log destruction.
This directly matches the technical requirement for tracking fileless process lineage.

Key Concept

Kernel-Level EDR Telemetry and Fileless Threat Visibility
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic