Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A security analyst receives an alert regarding an obfuscated command executing on a workstation assigned to an executive assistant. Traditional signature-based antivirus software on the host reported no malicious findings because the command payload was executed directly in memory without writing a file to the disk. However, the Endpoint Detection and Response (EDR) agent flagged the activity and blocked execution based on the anomalous process relationship where a word processing application spawned an encoded shell interpreter. Which EDR capability enabled the detection and intervention in this scenario?

  1. Behavioral anomaly detection and process lineage trackingAnswer
  2. B
    Static signature matching against a centralized file hash repository
  3. C
    Inbound perimeter firewall packet inspection and domain filtering
  4. D
    Automated patch management and vulnerability scanning

Answer

Behavioral anomaly detection and process lineage tracking enabled the EDR agent to detect and prevent the fileless memory execution.
The correct answer highlights behavioral anomaly detection and process lineage tracking. EDR solutions continuously record endpoint telemetry, including process trees, memory allocations, and command-line arguments. This allows EDR to identify suspicious behavior—such as a word processor spawning a command-line interpreter—even when no known malicious file signature exists.

Step-by-Step Solution

1
Analyze the attack vector and host indicators described in the scenario.
Identified that the attack uses fileless/in-memory execution by spawning a shell interpreter from a office document application without writing malicious files to disk.
Understanding the attack mechanism clarifies why signature-based controls fail.
2
Compare traditional antivirus capabilities with EDR functionalities.
Legacy antivirus relies on static file signatures and hashes, whereas EDR records host telemetry, tracks parent-child process lineage, and analyzes execution behaviors in real time.
Differentiating control mechanisms points to behavioral detection as the key capability.
3
Match the observed EDR intervention to the correct security feature.
The EDR agent detected the anomalous process lineage (word processor launching an encoded shell) and intervened dynamically.
Process lineage monitoring and behavioral heuristics directly address fileless and zero-day execution techniques.

Key Concept

EDR Behavioral Detection and Process Telemetry
Estimated Time:1m 15s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic